CVE-2026-25440 WPDeveloper CVE debrief

Who should care

Users of Essential Addons for Elementor versions prior to 6.6.0 should apply patches or mitigations as available.

Technical summary

The vulnerability (CVE-2026-25440) is caused by Unauthenticated Broken Access Control in Essential Addons for Elementor versions prior to 6.6.0. The Common Vulnerability Scoring System (CVSS) score is 5.3, indicating a MEDIUM severity level. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Defensive priority

This vulnerability is considered a MEDIUM severity issue. Users are advised to update to version 6.6.0 or later of Essential Addons for Elementor.

Recommended defensive actions

• Update Essential Addons for Elementor to version 6.6.0 or later.
• Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-5-13-broken-access-control-vulnerability?_s_id=cve) or
• Check the official CVE record at [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-25440) and
• View details on the NVD at [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-25440).

Evidence notes

Evidence suggests that this vulnerability was reported by Patchstack ([email protected]) and is related to CWE-862.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.