WordPress Plugin Vulnerabilities
Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification
Description
The plugin does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Proof of Concept
Affects Plugins
Fixed in 6.8.7 References
CVE
Miscellaneous
Original Researcher
Jashid Sany
Submitter
Jashid Sany
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-26 (about 2 days ago)
Added
2026-10-26 (about 1 day ago)
Last Updated
2026-10-26 (about 1 day ago)
