PatchSiren cyber security CVE debrief

CVE-2026-7284 themewant CVE debrief

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress contains a critical privilege escalation vulnerability in versions up to and including 1.4.4. The `easyel_handle_register` function fails to restrict user roles during registration, allowing unauthenticated attackers to specify arbitrary roles including 'administrator' during account creation. This grants immediate administrative access to the affected WordPress site. The vulnerability was disclosed on 2026-05-20 and carries a CVSS 3.1 score of 9.8 (Critical). A patch has been committed to the plugin repository.

Vendor: themewant
Product: Easy Elements for Elementor – Addons & Website Templates
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-20
Original CVE updated: 2026-05-20
Advisory published: 2026-05-20
Advisory updated: 2026-05-20

Who should care

WordPress site administrators using Easy Elements for Elementor plugin versions ≤1.4.4; security teams managing WordPress installations; hosting providers with shared WordPress environments

Technical summary

The vulnerability exists in the `easyel_handle_register` function within the Easy Elements for Elementor plugin. The function processes user registration requests without validating or restricting the `role` parameter, allowing attackers to inject arbitrary WordPress role values. By supplying 'administrator' as the role during registration, unauthenticated attackers gain full administrative control of the WordPress installation. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network attack vector, low complexity, no privileges required, no user interaction, and high impact across confidentiality, integrity, and availability.

Defensive priority

critical

Recommended defensive actions

Immediately update Easy Elements for Elementor plugin to version 1.4.5 or later
Review WordPress user accounts for unauthorized administrator accounts created since plugin installation
Implement temporary access controls or web application firewall rules to restrict registration endpoints if patching is delayed
Audit site configuration and plugin permissions for additional hardening
Consider disabling user registration functionality if not required for site operation

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository code review. The affected function `easyel_handle_register` in `class.login-register.php` at line 62 (version 1.4.0) lacks role validation. Patch committed in changeset 3534530.

Official resources

2026-05-20