Essential Addons EUVD-2026-108591

Exploitation requires a WordPress Multisite network (a non-default deployment mode) and that the attacker already holds administrator capability on at least one subsite (PR:H), with Essential Addons for Elementor's login-approval feature in use. The vulnerability is the plugin checking only a site-level capability instead of verifying authority over the specific targeted account. Limiting factors that reduce realistic risk: single-site (non-Multisite) installations are not affected, administrator-level authentication is required, and the impact is confined to changing the approval/login state of accounts rather than disclosing data.

This is a genuinely low-priority issue despite the 'Authentication Bypass' tag, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.8 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L, and the SSVC decision framework agrees: Exploitation=none, Automatable=no, Technical Impact=partial, yielding a vuln.today Decision label of 'monitor'. No CISA KEV listing and no EPSS score were provided in the input, so there is no signal of active or probable widespread exploitation. The decisive limiting factor is PR:H - exploitation requires the attacker to already hold administrator privileges on a subsite - combined with the fact that the flaw is only meaningful on WordPress Multisite networks, which are a minority deployment mode. The real-world impact is a cross-tenant authorization failure (CWE-863): a subsite administrator can alter the approval/login state of accounts on other sites, which is an integrity/availability concern, not data disclosure (C:N). One note for verification: the NVD vector uses S:U (unchanged scope), but because the impact reaches accounts belonging to other sites on the network - crossing a security-authority boundary - a scope change (S:C) is arguably more accurate; this does not change the overall low-priority conclusion.

On a WordPress Multisite network running Essential Addons for Elementor before 6.8.7, an administrator of one subsite invokes the plugin's login-approval feature. Because the plugin only checks a site-level capability rather than verifying the admin may manage the specific target account, the subsite admin can change the approval and login state of user accounts belonging to other sites on the network. No public exploit identified at time of analysis.