Essential Addons CVE-2026-118205

Exploitation is NOT a default-configuration drive-by despite PR:N. Concrete prerequisites, all drawn from the description: (1) the site must have 'Anyone can register' (WordPress Settings → General → Membership) enabled; (2) a page must contain the Essential Addons Login/Register widget; (3) an administrator must have, at some point, saved and then reverted a non-default 'New User Role' on that page, leaving a revision whose _elementor_data carries the elevated role. The attack mechanics: the register_user() handler's post-status deny-list rejects future/draft/pending but admits 'inherit' (the status of every revision), letting the attacker pass a revision ID as page_id; the 'last saved by administrator' check reads post_author on the revision (the editing admin) instead of the never-copied-to-revisions _edit_last meta; and the nonce gate is moot because any unauthenticated visitor can obtain a valid nonce from wp_ajax_nopriv_eael_get_token. Limiting factors that reduce real-world risk: the required admin save-then-revert history and open-registration setting are both non-default and attacker-uncontrolled, which is why AC is High even though authentication is not required.

This is a genuine but conditionally-gated issue rather than a drop-everything emergency. The CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures the tension well: the vector is network-reachable and unauthenticated (PR:N), which normally signals mass-exploitability, but AC:H reflects that success depends on target-specific preconditions the attacker does not control - specifically that an administrator previously saved and then reverted a non-default 'New User Role' on a page carrying the Login/Register widget, and that 'Anyone can register' is enabled. No EPSS score was supplied, so the statistical exploitation probability is unknown and cannot be weighed here. The vulnerability is NOT in CISA KEV and shows no active-exploitation signal: exploitation status is 'no public exploit identified at time of analysis' - the references are a Wordfence advisory, plugin source lines, and the fix changeset, not working exploit code. The SSVC/priority decision label is 'this_week', which is consistent with a serious privilege-escalation flaw in a very widely deployed plugin that nonetheless requires non-default site state to trigger. Net: prioritize patching within the normal weekly cycle; the AC:H preconditions make opportunistic mass exploitation unlikely, but the unauthenticated-to-Editor outcome on a hugely popular plugin justifies prompt action rather than deferral.

On a WordPress site that allows open registration and that has a page using the Essential Addons Login/Register widget where an admin once saved then reverted an elevated 'New User Role', an unauthenticated attacker first requests a valid nonce from the public wp_ajax_nopriv_eael_get_token endpoint. The attacker then calls register_user() supplying the ID of a page revision (post status 'inherit') instead of the live page, defeating the deny-list and the flawed author check so the reverted elevated role stored in the revision's _elementor_data is applied. The result is a self-registered Editor account with edit_others_posts, publish_pages, upload_files, and unfiltered_html. No public exploit code is identified at time of analysis, and AC:H reflects the required pre-existing site state.