What is the CVSS score of CVE-2026-25440?

CVE-2026-25440 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-25440?

Yes, a patch is available for CVE-2026-25440. Update the affected software to the latest version immediately.

Essential Addons for Elementor CVE-2026-25440

Q: Which versions of Essential Addons for Elementor are affected by CVE-2026-25440?

Unauthenticated Broken Access Control in the Essential Addons for Elementor WordPress plugin (all versions prior to 6.6.0) allows remote unauthenticated attackers to perform restricted actions…. A patch is available.

EUVD-2026-36912 MEDIUM

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-h6w4-m48p-mpf7

Authentication Bypass Essential Addons For Elementor Elementor

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no user interaction; only limited integrity impact from unauthorized action execution, no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:16 vuln.today

Patch available

Jun 15, 2026 - 22:32 EUVD

DescriptionCVE.org

Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

AnalysisAI

Unauthenticated Broken Access Control in the Essential Addons for Elementor WordPress plugin (all versions prior to 6.6.0) allows remote unauthenticated attackers to perform restricted actions without proper authorization. The root cause is a missing authorization check (CWE-862), permitting requests that should be gated behind authentication or capability checks to succeed. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated network-accessible nature (PR:N, AV:N) lowers the barrier to abuse significantly.

Technical ContextAI

Essential Addons for Elementor is a widely-deployed WordPress plugin developed by WPDeveloper (CPE: cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:*:*:*:*) that extends the Elementor page builder with additional widgets and features. CWE-862 (Missing Authorization) describes a class of flaws where code reaches a security-sensitive operation without first verifying that the caller holds the necessary permissions. In WordPress plugins, this commonly manifests as AJAX handlers, REST API endpoints, or admin-post actions that register callbacks accessible to unauthenticated users (e.g., registered under 'wp_ajax_nopriv_') while performing operations intended only for authenticated or privileged users. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerable endpoint is reachable over the network with no credentials and no user interaction, consistent with a publicly exposed WordPress action hook or REST route lacking a proper 'current_user_can()' capability gate.

RemediationAI

The primary remediation is to update Essential Addons for Elementor to version 6.6.0 or later, which contains the vendor-released patch per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-5-13-broken-access-control-vulnerability). Updates can be applied through the WordPress admin dashboard under Plugins > Installed Plugins > Update. If an immediate update is not possible, a compensating control is to use a Web Application Firewall (WAF) with WordPress-specific rulesets (e.g., Patchstack's virtual patching feature or Wordfence firewall rules) to block exploitation of the specific unauthorized endpoint until the patch can be applied. Restricting access to the WordPress AJAX and REST API endpoints at the network perimeter for unauthenticated users is an additional layer, but carries a trade-off of potentially breaking legitimate unauthenticated plugin functionality. No exact fix version beyond the 6.6.0 boundary is independently confirmed from the provided data.