Essential Addons EUVD-2026-111972

Exploitation requires a very specific configuration: the site must have BOTH the Essential Addons administrator-approval requirement for new registrations AND the plugin's email one-time-password (OTP) registration flow enabled simultaneously. Only the OTP registration path fails to enforce the approval gate, so sites using approval without the OTP flow (or not using Essential Addons registration at all) are not affected. When those prerequisites are met, no authentication, privileges, or user interaction are needed (AV:N/AC:L/PR:N/UI:N) and an unauthenticated remote attacker can self-register and log in. The limiting factor is this non-default dual-feature requirement, which should significantly reduce the number of exposed installations despite the plugin's broad deployment; affected versions are 6.7.3 through before 6.8.7.

This is a moderate, access-control (authorization bypass) issue rather than a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw with only limited integrity impact and no confidentiality or availability impact - consistent with the description, where the harm is that unapproved accounts become active, not direct data theft or code execution. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a medium-severity rating. No EPSS score and no CISA KEV entry were supplied, so there is no signal of active or probable exploitation; absence of these is not itself evidence of safety, but nothing here elevates urgency to immediate. A WPScan PoC reference exists but is not verified as working exploit code, so exploit maturity is uncertain. The most important mitigating signal is that the flaw only manifests 'when both features are enabled' - the administrator-approval requirement AND the email OTP registration flow - a non-default combination that materially narrows the exposed population. Note a conflict worth verifying: the input Tags label this 'Information Disclosure', yet the CVSS vector sets C:N and the description describes an approval/authorization bypass, so the mechanism is broken access control, not information disclosure.

On a WordPress site running Essential Addons for Elementor (6.7.3 through before 6.8.7) that has both administrator approval for new users and the email OTP registration flow enabled, an unauthenticated visitor self-registers through the email OTP path. Because the approval requirement is not enforced on that path, the account is treated as active and the attacker logs in immediately without any administrator having approved it. A WPScan PoC reference exists but is not verified as working exploit code; given AV:N/AC:L/PR:N/UI:N, exploitation is remote and requires no privileges or user interaction once the prerequisite features are enabled.