Easy Elements for Elementor CVE-2026-7284

The vulnerable site must have the Easy Elements for Elementor plugin (version ≤ 1.4.4) installed and active, and at least one page must render the plugin's login/register widget so the easyel_handle_register AJAX endpoint is reachable. No authentication, no user interaction, and no non-default configuration of the plugin itself is required - the role-parameter validation gap exists in the default code path. The only meaningful limiting factor is plugin presence and widget exposure; WordPress's global 'Anyone can register' setting is not required to be enabled because the plugin's handler performs its own registration outside the core wp-login flow.

The CVSS 9.8 score is well-supported by the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - network reachable, no authentication, no user interaction, and full CIA impact via administrator takeover. This is a textbook case where high CVSS reflects genuine high real-world risk: the exploitation primitive is a single HTTP POST with a manipulated role field, requires no special knowledge of the target, and is highly automatable across the WordPress install base. EPSS and KEV data were not provided in the input, but historical patterns for WordPress plugin privilege-escalation flaws (especially those disclosed by Wordfence) show rapid scanner adoption within days. No public exploit identified at time of analysis, however the trac changeset publicly shows the vulnerable code path, meaning anyone reading the patch diff can reconstruct the attack. Treat as immediate priority for any site running the plugin.

An attacker locates a WordPress site with the Easy Elements for Elementor plugin's login/register widget exposed on any public page, then submits a registration POST request that includes 'role=administrator' alongside the username, email, and password fields. The vulnerable easyel_handle_register function honors the supplied role without validation, provisioning a full administrator account; the attacker then logs in and installs a malicious theme or plugin to gain code execution. No public exploit identified at time of analysis, but the public source diff makes reconstruction trivial.