EUVD-2026-58598
GHSA-69j3-r66p-rg4r
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated registration path justifies AV:N and PR:N; AC:H reflects mandatory non-default field configuration prerequisite; full C/I/A from unrestricted admin account creation.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
AnalysisAI
Privilege escalation in the Essential Addons for Elementor WordPress plugin (versions 5.8.6 through before 6.7.2) permits unauthenticated remote attackers to self-register accounts with arbitrary WordPress roles, up to and including administrator, by supplying crafted values in user registration fields that overwrite reserved account attributes. The attack is gated on a non-default site configuration - specifically, a custom profile registration field with a particular label must have been set up by the site administrator - meaning only a subset of the estimated multi-million plugin install base is realistically exposed. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated path to full admin access makes affected sites a critical-priority remediation target.
Technical ContextAI
The root cause is CWE-269 (Improper Privilege Management) in the plugin's Elementor-integrated user registration form functionality. WordPress stores user roles as serialized capability data in the wp_usermeta table (the wp_capabilities key); the plugin's registration handler accepts arbitrary user-supplied field values and maps them onto account attributes without stripping or denylisting reserved WordPress meta keys. When a site operator configures a custom profile field whose label or internal key coincides with a reserved attribute - such as the capabilities or role meta - the plugin passes the attacker-controlled value directly into the account creation call, bypassing WordPress's own role-assignment logic. The affected version range, 5.8.6 to before 6.7.2, is confirmed by EUVD-2026-58598 and the WPScan advisory.
RemediationAI
Update Essential Addons for Elementor to version 6.7.2 or later, the vendor-released patch that resolves the improper privilege management flaw; this update is available immediately through the WordPress plugin dashboard or the WordPress.org repository. For sites that cannot patch immediately, disable the plugin's custom user registration form feature entirely within the Elementor settings panel - this removes the exposed code path at the cost of losing the registration widget functionality. After patching, administrators should audit all user accounts (especially those with administrator or editor roles) for unauthorized registrations created since the site first ran an affected version, as rogue accounts persist after the vulnerability is closed. The WPScan advisory at https://wpscan.com/vulnerability/2982ee81-3a85-435b-8347-a7848e99f373/ provides additional remediation context.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today