All vulnerabilities
CVE-2026-110537

Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action

Unknown Essential Addons for Elementor
Open in ThreatlineRecord JSON
CVSS
3.8Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.8.7Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 6.8.7Essential Addons for ElementorCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

Text from CVE List

Affected versions 1

  • Essential Addons for Elementoraffected: all versions before 6.8.7CVE List

References 1