8.1
High
CVE-2026-18039 The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields…
Description
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Essential Addons for Elementor 5.8 | 5.8.6 → < 6.7.2 | 6.7.2 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Essential Addons for Elementor
The 10 CVEs of Essential Addons for Elementor →
CVE-2026-110808
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role…
4.2
Medium
CVE-2026-110508
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement…
5.3
Medium
CVE-2026-110509
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an…
5.3
Medium
CVE-2026-110537
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the…
3.8
Low