CVE-2026-18039: Unknown Essential Addons For Elementor

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

Affected products

• Unknown Essential Addons For Elementor: from 5.8.6, before 6.7.2 (fixed in 6.7.2)

Published 2026-08-14. Last modified 2026-08-26.