CVE-2026-118205

{
  "id": "CVE-2026-118205",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-30T18:17:24.253",
  "lastModified": "2026-10-30T19:18:17.903",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed \"last saved by administrator\" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has \"Anyone can register\" enabled and that an administrator has at some point saved and then reverted a non-default \"New User Role\" on an affected page."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "wpdevteam",
          "product": "Essential Addons for Elementor – Popular Elementor Templates & Widgets",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "6.8.7",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T17:32:07.636874Z",
          "id": "CVE-2026-118205",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Classes/Bootstrap.php#L216",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Ajax_Handler.php#L1817",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L1059",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L2762",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L552",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L887",
      "source": "[email protected]"
    },
    {
      "url": "https://plugins.trac.wordpress.org/changeset/3770535/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a739cb9a-0b09-4303-8d4a-16fca1152adf?source=cve",
      "source": "[email protected]"
    }
  ]
}