CVE-2026-110508 Details
Description
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
A vulnerability exists in the Essential Addons for Elementor WordPress plugin in versions prior to 6.8.7. The issue arises because the plugin does not enforce its administrator approval requirement for accounts registered through the email one-time-password (OTP) verification process. This oversight could enable unauthenticated users to register and log in without prior administrative approval, provided both the OTP registration and login features are activated.
Users are advised to update the Essential Addons for Elementor WordPress plugin to version 6.8.7 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/77c4b22a-b1c2-4b65-b98c-e07489f94864/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Essential Addons for Elementor | >= 6.7.3, <= 6.8.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |