A 1 million-install WordPress plugin lets anyone register as an editor
CVE-2026-118205 lets an unauthenticated visitor forge the nonce that Essential Addons for Elementor uses to gate new signups. The vendor patched it without saying why.
Essential Addons for Elementor, a WordPress plugin with over a million active installs, has an unauthenticated privilege-escalation bug. Wordfence disclosed CVE-2026-118205 on 30 October, rated 7.4 on the CVSS scale: anyone can pull a valid nonce from the plugin’s wp_ajax_nopriv_eael_get_token endpoint, which is open to logged-out visitors by design, then pass it to register_user() to skip the role check meant to cap new signups at Subscriber.
It isn’t universal. The attack only works where user registration is switched on and an administrator has, at some point, saved and then reverted a non-default role setting. Where both hold, an attacker can register straight in with Editor-level access. The bug affects every version up to 6.8.7; the fix shipped in 6.8.8 on 28 October, two days before Wordfence’s disclosure, though the vendor’s own changelog for that release lists only unrelated UI and PHP-deprecation fixes, with no mention of a security patch.
Why it matters: if you run Essential Addons for Elementor, confirm you’re on 6.8.8 or later regardless of whether you recognise the two preconditions, since there’s no vendor advisory telling you which sites are exposed.
The caveat: Wordfence and the CVE record are the only sources here. The plugin’s own release notes don’t acknowledge a security fix, so there’s no primary confirmation of the root cause beyond the third-party writeups.