CVE-2026-25440 WPDeveloper CVE debrief

Who should care

Users of Essential Addons for Elementor versions prior to 6.6.0 should apply patches or mitigations as available.

Technical summary

The vulnerability (CVE-2026-25440) is caused by Unauthenticated Broken Access Control in Essential Addons for Elementor versions prior to 6.6.0. The Common Vulnerability Scoring System (CVSS) score is 5.3, indicating a MEDIUM severity level. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Defensive priority

This vulnerability is considered a MEDIUM severity issue. Users are advised to update to version 6.6.0 or later of Essential Addons for Elementor.

Recommended defensive actions

• Update Essential Addons for Elementor to version 6.6.0 or later.
• Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-5-13-broken-access-control-vulnerability?_s_id=cve) or
• Check the official CVE record at [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-25440) and
• View details on the NVD at [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-25440).

Evidence notes

Evidence suggests that this vulnerability was reported by Patchstack ([email protected]) and is related to CWE-862.

Official resources