Junglewise Threat Intelligence

CVE-2026-9018: Easy Elements for Elementor privilege escalation in easyel_handle_register

CVE-2026-9018 · Severity: high · CVSS 8.8 · Published 2026-05-22

Executive brief

A vulnerability in the Easy Elements for Elementor plugin for WordPress allows unauthorized individuals to gain full administrative control over a website. By exploiting a flaw in the user registration process, an attacker can create a new account and grant themselves the highest level of permissions. This could lead to a complete site takeover, data theft, or the installation of malicious software.

Technical details

The vulnerability exists in the `easyel_handle_register()` function within the `wp_ajax_nopriv_eel_register` AJAX handler. The code iterates through an attacker-controlled `custom_meta` POST array and applies every key-value pair to the new user's meta via `update_user_meta()` without validation or whitelisting. This allows an attacker to overwrite the `wp_capabilities` meta key immediately after account creation, elevating their role to 'administrator'. Exploitation requires that user registration is enabled and that the Login/Register widget is active on at least one page to leak the necessary `easy_elements_nonce`. All versions up to and including 1.4.5 are affected.

Affected products

  • Easy Elements Easy Elements for Elementor – Addons & Website Templates Up to, and including, 1.4.5

Timeline

  • 2026-05-22: advisory: NVD publication date

References

Related threats