CVE-2026-110537 Essential Addons for Elementor CVE debrief

Who should care

Defenders responsible for WordPress Multisite installations using the Essential Addons for Elementor plugin should assess exposure and verify the version of the plugin. They should also review user account approval and login states for potential suspicious activity and prioritize verifying the version of Essential Addons for Elementor and ensuring that administrators' access is properly restricted. Defenders should care about CVE-2026-110537 because it  

Why it matters

Defenders should care about CVE-2026-110537 because it allows unauthorized changes to user account approval and login states in WordPress Multisite installations using the Essential Addons for Elementor plugin before 6.8.7.

• Potential unauthorized changes to user account approval and login states
• Possible exploitation by subsite administrators in WordPress Multisite installations
• Verification of administrator access restrictions is necessary
• Remediation priority is moderate, as updating the plugin can mitigate the vulnerability

Technical summary

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network. This vulnerability affects WordPress Multisite installations and allows unauthorized changes to user account approval and login states. Defenders should prioritize verifying the version of Essential Addons for Elementor and ensuring that administrators' access is properly restricted.

Defensive priority

Defenders should prioritize verifying the version of Essential Addons for Elementor and ensuring that administrators' access is properly restricted.

Recommended defensive actions

• Verify the version of Essential Addons for Elementor and update to 6.8.7 or later
• Restrict administrator access to ensure that only authorized personnel can manage user accounts
• Monitor user account approval and login states for potential suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or affected versions. Defenders should verify the version of Essential Addons for Elementor and review user account approval and login states for potential suspicious activity. The vulnerability affects WordPress Multisite installations using the Essential Addons for Elementor plugin before 6.8.7. Limited evidence is available on exploitability, so defenders must exercise caution and monitor for unusual  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.