# CVE-2026-110537: Essential Addons for Elementor authorization bypass in user approval

Source: https://junglewise.ai/threats/cve-2026-110537-the-essential-addons-for-elementor-wordpress-plugin-before-6-8-7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-110537 · Severity: info · Published 2026-10-23

Essential Addons for Elementor is a WordPress plugin that adds features to the Elementor page builder, including a login-approval system for controlling user access. On WordPress Multisite installations, the plugin fails to properly verify which site a user belongs to before allowing an administrator to change their approval status, potentially allowing a subsite administrator to enable or disable login access for user accounts on other sites within the network.

Technologies: [Essential Addons for Elementor](https://junglewise.ai/threats/technologies/essential-addons-essential-addons-for-elementor). Vendors: [Essential Addons](https://junglewise.ai/threats/vendors/essential-addons).

## Quick answers

**Is CVE-2026-110537 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110537 being exploited in the wild.

**How severe is CVE-2026-110537?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Essential Addons for Elementor before 6.8.7.

**Is there a fix for CVE-2026-110537?** Yes: fixed in 6.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110537 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110537?** Check whether you run Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.8.7

## Technical details

The plugin's login-approval feature checks only a site-level capability without verifying that the administrator has permission to manage the specific user account being targeted. On WordPress Multisite, this allows a subsite administrator to use bulk actions to change the approval and login state of user accounts belonging to other sites in the network. This is an improper authorization/broken access control vulnerability (CWE-863).

## Affected products

- Essential Addons Essential Addons for Elementor before 6.8.7

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://wpscan.com/vulnerability/672ddaeb-b42f-4b8b-83ce-83e15899d651/](https://wpscan.com/vulnerability/672ddaeb-b42f-4b8b-83ce-83e15899d651/)

## Related threats

- [Essential Addons for Elementor registration approval bypass via OTP](https://junglewise.ai/threats/cve-2026-110508-the-essential-addons-for-elementor-wordpress-plugin-before-6-8-7)
- [Essential Addons for Elementor information disclosure via load_more](https://junglewise.ai/threats/cve-2026-110509-the-essential-addons-for-elementor-wordpress-plugin-before-6-8-7)
- [Essential Addons for Elementor content injection in widgets](https://junglewise.ai/threats/cve-2026-110510-the-essential-addons-for-elementor-wordpress-plugin-before-6-8-7)