CVE-2026-110537 — Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action

CVE-2026-110537

Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action PUBLISHED

Description (CNA)

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

Affected (CNA)

Vendor / product	Versions
Unknown / Essential Addons for Elementor	affected 0 before 6.8.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/672ddaeb-b42f-4b8b-83ce-83e15899d651/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.