CVE-2026-110808 Essential Addons for Elementor CVE debrief

Who should care

Defenders and administrators of WordPress sites using the Essential Addons for Elementor plugin should assess exposure and prioritize remediation due to potential unauthorized role escalation and privilege abuse. They should verify the affected plugin version, review user roles and permissions, and consider compensating controls for exposed systems.

Why it matters

CVE-2026-110808 allows authenticated users to assign higher roles to newly registered accounts, potentially leading to unauthorized role escalation and privilege abuse. Defenders and administrators of WordPress sites using the Essential Addons for Elementor plugin should assess exposure and prioritize remediation.

• Potential unauthorized role escalation
• Increased risk of privilege abuse
• Need for verification of user roles and permissions
• Priority for upgrading to version 6.8.8 or later

Technical summary

The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor.

Defensive priority

Defenders should prioritize verifying and upgrading to version 6.8.8 or later, and review user roles and permissions.

Recommended defensive actions

• Verify and upgrade to version 6.8.8 or later
• Review user roles and permissions
• Monitor for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. Defenders should verify the affected Essential Addons for Elementor plugin version and review user roles and permissions. The issue allows authenticated users with Author-level access and above to cause newly registered accounts to be granted a higher role such as Editor. Evidence is limited to public CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.