All vulnerabilities
CVE-2026-110508

Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification

Unknown Essential Addons for Elementor
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in6.8.7Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 6.8.7Essential Addons for ElementorCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.

Text from CVE List

Affected versions 1

  • Essential Addons for Elementoraffected: 6.7.3 before 6.8.7CVE List

References 1