CVE-2026-7284
Privilege Escalation via User Registration in Easy Elements for Elementor
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| easy_elements | easy_elements_for_elementor | to 1.4.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to register as administrators on a WordPress site, potentially leading to full site compromise.
Such unauthorized administrative access can result in unauthorized access to sensitive personal data, violating data protection requirements under regulations like GDPR and HIPAA.
Therefore, exploitation of this vulnerability could lead to non-compliance with these standards due to failure to protect data confidentiality, integrity, and availability.
Can you explain this vulnerability to me?
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress has a vulnerability that allows privilege escalation through user registration. Specifically, the function 'easyel_handle_register' does not restrict the user roles that can be assigned during registration. This means an unauthenticated attacker can register with the 'administrator' role and gain full administrator access to the WordPress site.
How can this vulnerability impact me? :
This vulnerability can have a severe impact because it allows an attacker to gain administrator-level access without authentication. With administrator privileges, the attacker can control the entire WordPress site, including modifying content, installing malicious plugins, stealing sensitive data, or disrupting site operations.