CVE-2026-18039 — Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment

CVE-2026-18039

Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment PUBLISHED

Description (CNA)

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

Affected (CNA)

Vendor / product	Versions
Unknown / Essential Addons for Elementor	affected 5.8.6 before 6.7.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2982ee81-3a85-435b-8347-a7848e99f373/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.