Privilege Escalation in Essential Addons for Elementor by WPStyle

CVE-2026-118205

What is CVE-2026-118205?

The Essential Addons for Elementor plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the page_id parameter within the register_user() function. This issue arises due to the handler's post status restrictions, which inadvertently allows the use of an inherit status linked to WordPress revisions. This means an attacker can replace a live page ID with a revision ID that contains elevated access permissions. Consequently, if the site's 'Anyone can register' option is enabled, attackers can create user accounts with roles such as Editor, granting them considerable capabilities including the ability to edit posts, publish pages, and upload files. Successful exploitation hinges on the presence of a specific page's revision data where a prior user role was saved and then reverted.

References