CVE-2026-110808
Received Received - Intake

Privilege Escalation in Essential Addons for Elementor

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: WPScan

Description
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that are patched against that advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-110808
EUVD
EUVD-2026-114581

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Essential Addons for Elementor 6.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Essential Addons for Elementor WordPress plugin versions 6.6.0 through 6.8.7. It allows authenticated users with Author-level access or higher to bypass role restrictions in the plugin's registration form, granting higher roles like Editor to newly created accounts, including those from unauthenticated public registrations. This is a bypass of a previous fix for CVE-2026-5193, meaning even patched sites remain vulnerable.

Detection Guidance

Check the installed version of Essential Addons for Elementor. If it is between 6.6.0 and 6.8.7, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

An attacker with Author-level access or higher could escalate their privileges or grant elevated roles to other users, potentially taking control of the WordPress site. Unauthenticated users could also register accounts with higher privileges, leading to unauthorized access and control of the site.

Mitigation Strategies

Update Essential Addons for Elementor to version 6.8.8 or later immediately. If updating is not possible, consider disabling the plugin or restricting access to the registration form until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart