What is the CVSS score of CVE-2026-7284?

CVE-2026-7284 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Easy Elements for Elementor are affected by CVE-2026-7284?

CVE-2026-7284 in Easy Elements for Elementor poses critical risk to WordPress sites by allowing unauthenticated attackers to register as administrators and seize full control of affected…

How to fix or mitigate CVE-2026-7284?

Within 24 hours: Identify and disable the Easy Elements for Elementor plugin on all WordPress sites running version ≤1.4.4. Within 7 days: Remove the plugin completely from all affected installations. Within 30 days: Conduct security audit of affected WordPress instances for evidence of unauthorized administrator account creation.

Easy Elements for Elementor CVE-2026-7284

EUVD-2026-31019 CRITICAL

Improper Privilege Management (CWE-269)

2026-05-20 Wordfence

GHSA-3mmh-p93r-vxvf

WordPress Privilege Escalation Elementor

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:30 vuln.today

DescriptionCVE.org

The Easy Elements for Elementor - Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

AnalysisAI

Privilege escalation in the Easy Elements for Elementor WordPress plugin (versions up to and including 1.4.4) allows unauthenticated remote attackers to register accounts with the 'administrator' role, granting full site takeover. The flaw exists in the 'easyel_handle_register' function which fails to validate or restrict the user role parameter submitted during registration. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's disclosure make weaponization straightforward.

Technical ContextAI

The vulnerability resides in the 'easyel_handle_register' handler within the plugin's login-register widget (class.login-register.php). The plugin extends WordPress's user registration capability through Elementor widgets but accepts a user-supplied 'role' parameter without server-side allowlist validation. This maps to CWE-269 (Improper Privilege Management), where the application trusts client-controlled input to determine authorization level. The affected CPE is cpe:2.3:a:themewant:easy_elements_for_elementor_-_addons_&_website_templates, indicating the ThemeWant-published plugin distributed via the WordPress.org plugin repository.

RemediationAI

Upstream fix available (changeset 3534530); released patched version not independently confirmed from the provided data, but administrators should upgrade to the latest available release of Easy Elements for Elementor immediately (post-1.4.4) per the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/32b6ccfe-a659-41e4-9cec-146f4f910071 and the WordPress.org changeset at https://plugins.trac.wordpress.org/changeset/3534530/easy-elements. As immediate compensating controls if patching is delayed, disable the plugin entirely via wp-admin or by renaming the plugin directory (trade-off: any Elementor templates or login/register widgets provided by this plugin will break), or set WordPress's 'users_can_register' option to false under Settings → General to disable open registration site-wide (trade-off: legitimate self-service signup is also disabled). Additionally, audit wp_users for unexpected administrator accounts created in the exposure window and rotate credentials and secrets if any are found.