CVE-2026-118205
Deferred Deferred - Pending Action

Privilege Escalation in Essential Addons for Elementor

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Wordfence

Description
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118205
EUVD
EUVD-2026-114227

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows unauthenticated attackers to escalate privileges to Editor role by exploiting flaws in the page_id parameter handling and nonce verification. The issue involves manipulating revision IDs to bypass security checks, enabling account registration with elevated permissions.

Impact Analysis

If exploited, attackers could gain administrative-like access to your WordPress site, allowing them to create posts, modify content, upload files, and potentially take full control of your website. This requires only that 'Anyone can register' is enabled and an admin previously saved a page with a non-default user role.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Unauthorized privilege escalation risks exposing sensitive user data and violating compliance mandates for access controls and audit logging.

Mitigation Strategies

Immediately update the Essential Addons for Elementor plugin to the latest version beyond 6.8.7. Disable the 'Anyone can register' setting in WordPress if not required. Review user roles and remove unnecessary elevated permissions. Monitor for unauthorized user registrations or privilege changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118205. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart