Executive brief
A popular WordPress plugin used to add custom design elements to websites contains a security flaw that allows certain users to gain higher permissions. Specifically, users with 'author' level access can create new accounts with 'editor' privileges, bypassing intended security restrictions. This could allow a lower-level staff member or contributor to gain unauthorized control over website content and management.
Technical details
The vulnerability exists within the 'register_user' function of the Essential Addons for Elementor plugin. The root cause is improper privilege management (CWE-269) where the function's role validation logic only explicitly blocks the 'administrator' role, failing to restrict other high-privilege roles. An authenticated attacker with Author-level permissions or higher can exploit this over the network to register new users with the 'Editor' role. This flaw affects all versions up to and including 6.5.13. A patch has been identified in the plugin's development changeset.
Affected products
- WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets Up to, and including, 6.5.13
Timeline
- 2026-05-14: advisory: NVD and Wordfence published the vulnerability details.
- 2026-05-14: disclosed