WordPress Plugin Vulnerabilities

Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment

Description

The plugin does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

Proof of Concept

Affects Plugins

Plugin icon
essential-addons-for-elementor-lite
Fixed in 6.7.2

References

CVE
CVE-2026-18039

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://jakubherman.net
Verified
Yes
WPVDB ID
2982ee81-3a85-435b-8347-a7848e99f373

Timeline

Publicly Published
2026-08-12 (about 2 days ago)
Added
2026-08-12 (about 1 day ago)
Last Updated
2026-08-13 (about 9 hours ago)

Other

Published
Title
Published
2026-01-08
Title
Frontend Admin by DynamiApps < 3.28.30 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
Published
2023-05-23
Title
ReviewX < 1.6.14 - Subscriber+ Privilege Escalation
Published
2026-08-11
Title
AcyMailing < 11.0.0 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
Published
2026-07-28
Title
Wholesale for WooCommerce < 2.0.6 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter
Published
2020-03-16
Title
LearnPress < 3.2.6.7 - Privilege Escalation