CVE-2026-118205

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the page id parameter of the register user() function. The vulnerability exists because the handler's post status deny-list rejects future, draft, and pending but admits inherit — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads post author on revisions (which reflects the editing administrator) rather than the edit last meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the wp ajax nopriv eael get token endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including edit others posts, publish pages, upload files, and unfiltered html — by naming a revision whose elementor data contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.