EUVD-2026-36912
GHSA-h6w4-m48p-mpf7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable unauthenticated endpoint with no user interaction; only limited integrity impact from unauthorized action execution, no confidentiality or availability consequence.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
AnalysisAI
Unauthenticated Broken Access Control in the Essential Addons for Elementor WordPress plugin (all versions prior to 6.6.0) allows remote unauthenticated attackers to perform restricted actions without proper authorization. The root cause is a missing authorization check (CWE-862), permitting requests that should be gated behind authentication or capability checks to succeed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector PR:N and the vulnerability description both confirm unauthenticated exploitation is possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.3 (Medium) reflects a limited-impact integrity flaw: the attack vector is network (AV:N), complexity is low (AC:L), no privileges or user interaction are required (PR:N/UI:N), scope is unchanged (S:U), and the only impact is low integrity (I:L) with no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker identifies a WordPress site running Essential Addons for Elementor below version 6.6.0 - readily detectable via plugin enumeration or HTTP response headers. The attacker sends a crafted HTTP POST request directly to the vulnerable unprotected WordPress endpoint (such as an admin-ajax.php action or REST route) without supplying any authentication credentials. … |
| Remediation | The primary remediation is to update Essential Addons for Elementor to version 6.6.0 or later, which contains the vendor-released patch per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-5-13-broken-access-control-vulnerability). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today