CVE-2026-110508 in Essential Addons for Elementor Plugin
Summary
by MITRE • 10/28/2026
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Essential Addons for Elementor WordPress plugin version 6.8.7 and earlier contains a critical authentication bypass vulnerability that undermines the intended administrative control over user registration workflows. This flaw specifically affects scenarios where two distinct security mechanisms are simultaneously active: the requirement for administrator approval of new accounts and the email one-time-password (OTP) verification flow. The core issue lies in an inconsistent implementation of access controls across different registration pathways within the plugin's codebase. While standard registration forms correctly enforce a pending status that requires manual review by a site administrator before granting login privileges, the OTP-based registration process fails to apply this same restriction. This inconsistency creates a significant gap in the security posture of WordPress sites utilizing these features together.
From a technical perspective, the vulnerability stems from insufficient validation logic during the account creation phase for users authenticating via email OTP. When an unauthenticated user initiates login through the OTP flow and successfully verifies their identity by entering the code sent to their email address, the system automatically grants them full access without checking whether administrator approval has been granted or even initiated. The application fails to query the database for a pending status flag associated with that specific account before establishing a session. This allows any individual who can receive an email at a registered address to bypass administrative oversight entirely. In environments where user-generated content, membership areas, or privileged roles are managed through this plugin, such unrestricted access poses severe risks including data leakage, unauthorized modifications, and potential escalation of privileges if default WordPress capabilities allow further exploitation after initial login.
The operational impact of this vulnerability is substantial for organizations relying on granular control over who can access their web applications. Attackers do not need to exploit complex injection flaws or reverse-engineer cryptographic algorithms; they simply need a valid email address associated with an account in the system's database, whether existing or newly created through other means that might have left accounts unapproved. Once logged in without approval, malicious actors can perform actions permitted by their assigned role. If the site allows default subscriber roles to post comments, edit profiles, or access private content, this bypass effectively neutralizes the administrator approval feature designed to prevent spam and unauthorized participation. In more severe cases where higher-level roles are involved or if combined with other vulnerabilities like cross-site scripting stored in user profiles, the impact can escalate to full site compromise or persistent backdoor installation.
This vulnerability aligns closely with CWE-284 Improper Access Control, as it represents a failure to enforce proper restrictions on authenticated users regarding their ability to access resources based on administrative decisions. Furthermore, from an adversary simulation standpoint consistent with MITRE ATT&CK frameworks, this flaw facilitates the Initial Access tactic by allowing unauthenticated actors to gain foothold in the system without detection or approval workflows that might trigger alerts. It also relates to CWE-601 URL Redirection to Untrusted Site in some interpretations if the OTP flow involves redirects, but primarily it is an access control bypass where identity verification succeeds but authorization checks fail.
To mitigate this risk, site administrators should immediately update the Essential Addons for Elementor plugin to version 6.8.7 or later, which addresses the logic gap by ensuring that administrator approval requirements are uniformly applied regardless of the authentication method used during registration. Until an upgrade is possible, temporary mitigations include disabling the email OTP login feature if it is not strictly necessary, thereby forcing all users through the standard registration flow where administrative checks function correctly. Additionally, reviewing user accounts for any recently created entries lacking proper status flags can help identify potentially compromised or unauthorized access points. Regular audits of plugin configurations and adherence to least-privilege principles regarding default WordPress roles further reduce the blast radius should such vulnerabilities be present in other components of the stack.