Is CVE-2026-5193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5193 being exploited in the wild.

How severe is CVE-2026-5193?

Medium severity, with a CVSS score of 6.5, published 14 May 2026.

Which products and versions are affected?

WPDeveloper Essential Addons for Elementor Up to, and including, 6.5.13.

Is there a fix for CVE-2026-5193?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5193 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5193?

Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5193: WPDeveloper Essential Addons for Elementor privilege escalation

CVE-2026-5193 · Severity: medium · CVSS 6.5 · Published 2026-05-14

A popular WordPress plugin used to add custom design elements to websites contains a security flaw that allows certain users to gain higher permissions. Specifically, users with 'author' level access can create new accounts with 'editor' privileges, bypassing intended security restrictions. This could allow a lower-level staff member or contributor to gain unauthorized control over website content and management.

Technologies: WPDeveloper Essential Addons for Elementor. Vendors: WPDeveloper.

Quick answers

Is CVE-2026-5193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5193 being exploited in the wild.
How severe is CVE-2026-5193?: Medium severity, with a CVSS score of 6.5, published 14 May 2026.
Which products and versions are affected?: WPDeveloper Essential Addons for Elementor Up to, and including, 6.5.13.
Is there a fix for CVE-2026-5193?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5193 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5193?: Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists within the 'register_user' function of the Essential Addons for Elementor plugin. The root cause is improper privilege management (CWE-269) where the function's role validation logic only explicitly blocks the 'administrator' role, failing to restrict other high-privilege roles. An authenticated attacker with Author-level permissions or higher can exploit this over the network to register new users with the 'Editor' role. This flaw affects all versions up to and including 6.5.13. A patch has been identified in the plugin's development changeset.

Affected products

WPDeveloper Essential Addons for Elementor – Popular Elementor Templates & Widgets Up to, and including, 6.5.13

Timeline

2026-05-14: advisory: NVD and Wordfence published the vulnerability details.
2026-05-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.