Essential Addons EUVD-2026-104135

Exploitation requires the attacker to already hold a high-privilege authenticated WordPress account (PR:H), plus required user interaction (UI:R - e.g., a victim/administrator performing an action) and high attack complexity (AC:H - additional conditions outside the attacker's control must hold), on a site running Essential Addons for Elementor from an unspecified early version through 6.8.5. Limiting factors that reduce real-world risk: it is not remotely reachable by an unauthenticated attacker, it depends on a multi-user configuration where a less-than-full-admin privileged account exists to escalate from, and the required user interaction plus high complexity make reliable opportunistic exploitation difficult. Sites with only a single administrator account have a much smaller practical exposure.

This is a moderate-severity (CVSS 6.4) privilege escalation flaw (CWE-266, Incorrect Privilege Assignment) in the Essential Addons for Elementor WordPress plugin, reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) is internally consistent for a constrained attack: although network-reachable, it requires high existing privileges (PR:H), a victim to perform some action (UI:R), and high attack complexity (AC:H), which collectively suppress the otherwise full C/I/A impact down to a medium score. No EPSS probability was provided, the vulnerability is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The combination of PR:H + UI:R + AC:H means this is unlikely to see opportunistic mass exploitation and is better characterized as a real-but-low-urgency hardening issue rather than an emergency: a high-privilege actor abusing privilege assignment is the core scenario. Note the tension worth verifying: PR:H plus privilege escalation implies an already-privileged (e.g., contributor/author/admin-adjacent) user escalating further, so the practical attacker population is limited to authenticated users on multi-user sites.

On a multi-author WordPress site running Essential Addons for Elementor ≤6.8.5, an authenticated user who already holds an elevated role abuses the plugin's incorrect privilege assignment to gain capabilities beyond what their role should permit. Because the CVSS vector specifies high attack complexity and required user interaction, the attacker must satisfy additional non-trivial conditions (such as a specific site state or an administrator performing an action) for the escalation to succeed. No public exploit code is referenced for this CVE.