Vulnerability · Published Oct 28, 2026 · Assigned by WPScan
CVE-2026-110508Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification
Medium 5.3
In plain English
A medium-severity missing authorization in Essential Addons for Elementor from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Essential Addons for Elementor | 6.7.3 – before 6.8.7 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/77c4b22a-b1c2-4b65-b98c-e07489f94864/ exploit, vdb-entry, technical-description