WordPress Plugin Vulnerabilities
Essential Addons for Elementor < 6.6.0 - Author+ Limited Privilege Escalation via register_user
Description
The plugin is vulnerable to privilege escalation due to insufficient role validation in the `register_user` function, which only blocks the `administrator` role. This makes it possible for authenticated attackers, with Author-level access and above, to create new user accounts with elevated privileges such as Editor.
Affects Plugins
References
Classification
Type
PRIVESC
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Athiwat Tiprasaharn (Jitlada)
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-05-13 (about 27 days ago)
Added
2026-05-18 (about 21 days ago)
Last Updated
2026-05-18 (about 21 days ago)