Essential Addons EUVD-2026-114581

Requires an authenticated WordPress account at Author level or above on a site running Essential Addons for Elementor version 6.6.0 through 6.8.7 that has the plugin's user registration form feature in use. The attacker abuses the registration form's role-assignment handling to set a higher role (e.g., Editor) on newly created accounts, including accounts created by unauthenticated visitors via the public registration form. Limiting factors: the attacker must already be authenticated (Author-level, a lower-privileged but still non-public role), the registration form must be configured/enabled, and the escalation is bounded to a 'higher role such as Editor' rather than guaranteed administrator; the input vector also rates attack complexity high (AC:H), though the sources do not describe why the trigger is complex. Sites on 6.6.0-6.8.7 remain affected even if previously patched against CVE-2026-5193.

Signals point consistently to a moderate, non-urgent privilege-escalation issue rather than a high-priority emergency. The input CVSS base score is 4.2 (medium), EPSS is very low at 0.18% (7th percentile), there is no CISA KEV listing, and the SSVC framework reports Exploitation: none, Automatable: no, Technical Impact: partial - all aligning with the vendor-tool Decision label of 'this_month' (not act_now/emergency). A key internal conflict must be flagged: the supplied CVSS vector uses PR:H (high privilege), yet the description states the attacker only needs Author-level access 'and above', which is a low-privileged authenticated WordPress role - so the vector appears to overstate the required privilege and PR:L is a more defensible reading; verify with the WPScan advisory. The impact is bounded: the flaw grants a 'higher role such as Editor', not necessarily full administrator, so it is integrity-focused escalation rather than immediate full site takeover. Importantly this is an incomplete fix of CVE-2026-5193 - the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user - so sites that believed they were patched against the earlier advisory remain exposed on 6.6.0 through 6.8.7. Net: real but not critical; a planned patch to 6.8.8 is warranted this month.

On a WordPress site running Essential Addons for Elementor 6.6.0-6.8.7 that uses the plugin's registration form, an attacker holding an Author-level (or higher) account submits a crafted request that bypasses the 6.6.0 role-validation control and causes newly created accounts - including those registered by unauthenticated visitors through the public form - to be assigned an elevated role such as Editor. Because AC is rated high and the attacker already needs an authenticated account, this is a constrained rather than mass-exploitable attack. No public exploit code was identified in the provided data.