CVE-2026-118205— Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

Quick assessment

Affected

wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Essential Addons for Elementor – Popular Elementor Templates & Widgets"在所有 6.8.7 及更早版本中存在权限提升漏洞。该漏洞源于函数中的参数处理逻辑存在缺陷。具体而言，处理程序对文章状态的拒绝列表仅包含、和，却允许状态（该状态由所有 WordPress 修订版本携带）。这使得攻击者可以用修订版本的 ID 替换正常页面的 ID。与此同时，一个存在缺陷的“最后由管理员保存”检查机制，在读取修订版本时错误地使用

CVSS 7.4 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1551.001 T1068.001 T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
wpdevteam	Essential Addons for Elementor – Popular Elementor Templates & Widgets	`≤ 6.8.7`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

Source: CVE Program / CVE List V5

Vulnerability Description

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler's post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` — the status carried by every WordPress revision — allowing an attacker to substitute a revision ID for a live page ID, while a flawed "last saved by administrator" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor — gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` — by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has "Anyone can register" enabled and that an administrator has at some point saved and then reverted a non-default "New User Role" on an affected page.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wpdevteam	Essential Addons for Elementor – Popular Elementor Templates & Widgets	0 ~ 6.8.7	-

II. Public POCs for CVE-2026-118205

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118205

请登录查看更多情报信息。

Other References for CVE-2026-118205 (8)

https://www.cve.org/CVERecord?id=CVE-2026-118205

IV. Related Vulnerabilities

Same product: Essential Addons for Elementor – Popular Elementor Templates & Widgets

Same vendor: wpdevteam

Same weakness: CWE-269