What is the CVSS score of CVE-2026-5193?

CVE-2026-5193 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Essential Addons for Elementor CVE-2026-5193

EUVD-2026-30248 MEDIUM

Improper Privilege Management (CWE-269)

2026-05-14 Wordfence

GHSA-xr97-92r9-j322

WordPress Privilege Escalation Wordpress Plugin Essential Addons For Elementor Popular Elementor Templates Widgets Elementor Wpdevteam

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:55 vuln.today

CVE Published

May 14, 2026 - 06:44 nvd

MEDIUM 6.5

DescriptionCVE.org

The Essential Addons for Elementor - Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'register_user' function, which only blocks the 'administrator' role. This makes it possible for authenticated attackers, with author level access and above, to create new user accounts with elevated privileges such as editor.

AnalysisAI

Privilege escalation in Essential Addons for Elementor (all versions ≤ 6.5.13) allows authenticated WordPress users with Author-level access or above to create new accounts with elevated roles such as Editor by exploiting the plugin's register_user function, which applies an incomplete role denylist that blocks only 'administrator' while leaving other privileged roles unguarded. The network-accessible, low-complexity attack vector (AV:N/AC:L/PR:L) makes this realistic for any site with the plugin's registration widget exposed and populated with low-trust authors. No public exploit has been identified at time of analysis and CISA KEV status is absent, but the plugin's broad WordPress deployment increases aggregate exposure.

Technical ContextAI

The vulnerability resides in the register_user function within the Login_Registration PHP trait of the Essential Addons for Elementor plugin (CPE: cpe:2.3:a:wpdevteam:essential_addons_for_elementor_-_popular_elementor_templates_&_widgets), located at trunk/includes/Traits/Login_Registration.php as confirmed by the WordPress plugin SVN changeset 3499726. The plugin extends Elementor with pre-built widgets including custom front-end registration forms. CWE-269 (Improper Privilege Management) identifies the root cause: the function enforces a denylist strategy that explicitly filters only the 'administrator' role during registration rather than validating the submitted role against an allowlist of permitted values. WordPress's role system includes Editor, Author, Contributor, and Subscriber by default, and third-party plugins (e.g., WooCommerce) add further roles - none of which are blocked by the flawed logic, enabling a registered low-privilege user to self-assign a higher role at account creation time.

RemediationAI

An upstream fix has been committed to the WordPress plugin SVN repository (changeset 3499726: https://plugins.trac.wordpress.org/changeset/3499726/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php); however, the exact released patched version number is not independently confirmed from available input data - the patch version is inferred to be above 6.5.13. Administrators should update to the latest available version via the WordPress plugin dashboard and confirm the installed version exceeds 6.5.13 after update. As an immediate compensating control, disabling the Essential Addons for Elementor front-end registration widget eliminates the attack surface entirely - note this will remove custom registration form functionality from affected pages, which may require replacing with an alternative. Administrators should also audit existing WordPress user accounts for unexpected Editor-level entries that may have been created prior to patching, and restrict Author-level account provisioning to trusted individuals. The Wordfence advisory should be monitored for confirmation of the exact patched release version.