CVE-2026-9018
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The Easy Elements for Elementor plugin for WordPress up to version 1.4.5 contains a privilege escalation vulnerability in the easyel_handle_register() function. An unauthenticated attacker can register a new account with full administrator privileges by supplying custom_meta[wp_capabilities][administrator]=1 in an AJAX request.
Risk Assessment
An attacker can gain full control over the WordPress site by registering an admin account without any authentication, if user registration is enabled and a login/register widget is present on the site.
Recommendation
Update the Easy Elements for Elementor plugin to the latest version that fixes this vulnerability, and consider disabling user registration if not needed.
Other vulnerabilities in Easy Elements for Elementor
Original NVD description (English source)
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the `easyel_handle_register()` function. This is due to the `wp_ajax_nopriv_eel_register` AJAX handler iterating the attacker-controlled `custom_meta` POST array and writing every supplied key-value pair to the newly created user's meta via `update_user_meta()` without any key whitelist or blocklist, allowing the `wp_capabilities` user meta key to be overwritten after `wp_insert_user()` has already assigned a safe role. This makes it possible for unauthenticated attackers to register a new account with full administrator-level privileges by supplying `custom_meta[wp_capabilities][administrator]=1`. Exploitation requires that user registration is enabled on the site and that at least one page exposes the Login/Register widget, which publishes the required `easy_elements_nonce` into the page DOM where it can be retrieved by any unauthenticated visitor via a simple GET request.