Skip to main content

Essential Addons for Elementor CVE-2026-81777

| EUVDEUVD-2026-67656 MEDIUM
Authentication Bypass by Spoofing (CWE-290)
2026-08-28 Patchstack GHSA-5rxq-3jv4-hmv2
WordPress Authentication Bypass Essential Addons For Elementor Wordpress Plugin Wpdeveloper
5.3
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
5.3 MEDIUM

Network-accessible CAPTCHA bypass requires no authentication or interaction; only limited integrity impact as verification is circumvented without exposing confidential data.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 28, 2026 - 12:16 vuln.today
CVE Published
Aug 28, 2026 - 09:42 cve.org
MEDIUM 5.3

DescriptionCVE.org

Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing.

This issue affects Essential Addons for Elementor: from n/a through 6.8.0.

AnalysisAI

Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target WordPress site has Essential Addons for Elementor installed and active at version 6.8.0 or below, and that at least one CAPTCHA-enabled widget (such as the Login or Register form widget) is deployed on a publicly accessible page. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 3.1 score of 5.3 (Medium) reflects the constrained impact profile: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update Essential Addons for Elementor to a version above 6.8.0 via the WordPress plugin dashboard or manually from the WPDeveloper repository; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-7-3-captcha-bypass-vulnerability should be consulted for the confirmed patched release version, as the exact fix version is not independently confirmed from the CVE record alone. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Essential Addons For Elementor

View all
CVE-2023-32243 CRITICAL POC
9.8 May 12

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.4.0 thro
CVE-2025-24752 HIGH POC
7.1 Apr 17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essent
CVE-2026-13345 MEDIUM POC
5.3 Jul 30

Unauthenticated information disclosure in Essential Addons for Elementor (WordPress plugin, all versions before 6.6.10)

CVE-2024-3018 HIGH
8.8 Mar 30

The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and
CVE-2026-13344 MEDIUM POC
4.8 Jul 30

Stored XSS in Essential Addons for Elementor (WordPress plugin) before 6.6.10 allows any Contributor-level or higher use
CVE-2024-1536 HIGH
7.4 Mar 13

The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress
CVE-2024-39649 MEDIUM
6.5 Aug 01

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essent
CVE-2024-4448 MEDIUM
6.4 May 14

The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress
CVE-2025-39590 MEDIUM
6.5 Apr 16

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essent
CVE-2024-56063 MEDIUM
6.5 Dec 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essent
CVE-2024-5073 MEDIUM
6.4 May 30

The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress
CVE-2024-4624 MEDIUM
6.4 May 14

The Essential Addons for Elementor - Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPres

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-81777 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy