Essential Addons for Elementor CVE-2026-18039

Exploitation requires two simultaneous conditions: (1) the target WordPress site must have the Essential Addons for Elementor plugin installed at a version between 5.8.6 and before 6.7.2, and (2) a site administrator must have specifically configured a custom user registration form field - within the plugin's Elementor registration widget - with a label or meta key that the plugin maps to a reserved WordPress account attribute such as the role or capabilities field. Sites that use the plugin without a custom registration form, or with registration forms that do not include the specific triggering field configuration, are not exploitable. The CVSS PR:N confirms no authentication is required to submit the registration request, but AC:H captures the hard prerequisite of this non-default field configuration. Exploitation is further limited by the need to identify the specific field label that triggers the bypass, which is not publicly disclosed in the advisory - an attacker must either enumerate the registration form response or iterate through likely meta key names.

The NVD CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly reflects both the severity of impact and the non-trivial precondition: AC:H captures the requirement for a specific non-default field configuration on the target site, meaningfully narrowing the exploitable population relative to a blanket AV:N/AC:L scenario. The EPSS score of 0.15% at the 4th percentile is very low, indicating minimal observed automated scanning or exploitation in threat telemetry and suggesting this is not being mass-exploited at time of analysis. There is no CISA KEV entry and no identified POC. These signals collectively suggest the vulnerability is known to researchers but not yet actively weaponized. For sites that do meet the configuration prerequisite, however, the impact is binary and catastrophic - unauthenticated admin account creation equals complete site compromise - so affected deployments should treat this as urgent regardless of the low EPSS. No conflicts between CVSS and description text were identified; the AC:H designation is well-grounded in the condition described.

An attacker enumerates a WordPress site using Essential Addons for Elementor and identifies a front-end registration form that contains a custom field whose meta key maps to a reserved WordPress account attribute. The attacker submits a crafted POST request to the registration endpoint, setting the vulnerable field value to the WordPress administrator capability string; the plugin passes this value through to the wp_insert_user call without sanitization, creating an account with full administrator privileges. The attacker then authenticates with the newly created admin account and achieves complete WordPress site compromise, including the ability to install arbitrary plugins, access all site data, or use the web server as a pivot point.