PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7284 themewant CVE debrief

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress contains a critical privilege escalation vulnerability in versions up to and including 1.4.4. The `easyel_handle_register` function fails to restrict user roles during registration, allowing unauthenticated attackers to specify arbitrary roles including 'administrator' during account creation. This grants immediate administrative access to the affected WordPress site. The vulnerability was disclosed on 2026-05-20 and carries a CVSS 3.1 score of 9.8 (Critical). A patch has been committed to the plugin repository.

Vendor
themewant
Product
Easy Elements for Elementor – Addons & Website Templates
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-24
Advisory published
2026-05-20
Advisory updated
2026-07-24

Who should care

WordPress site administrators using Easy Elements for Elementor plugin versions ≤1.4.4; security teams managing WordPress installations; hosting providers with shared WordPress environments

Technical summary

The vulnerability exists in the `easyel_handle_register` function within the Easy Elements for Elementor plugin. The function processes user registration requests without validating or restricting the `role` parameter, allowing attackers to inject arbitrary WordPress role values. By supplying 'administrator' as the role during registration, unauthenticated attackers gain full administrative control of the WordPress installation. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network attack vector, low complexity, no privileges required, no user interaction, and high impact across confidentiality, integrity, and availability.

Defensive priority

critical

Recommended defensive actions

  • Immediately update Easy Elements for Elementor plugin to version 1.4.5 or later
  • Review WordPress user accounts for unauthorized administrator accounts created since plugin installation
  • Implement temporary access controls or web application firewall rules to restrict registration endpoints if patching is delayed
  • Audit site configuration and plugin permissions for additional hardening
  • Consider disabling user registration functionality if not required for site operation

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository code review. The affected function `easyel_handle_register` in `class.login-register.php` at line 62 (version 1.4.0) lacks role validation. Patch committed in changeset 3534530.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7284 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7284

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7284 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7284

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.