CVE-2026-110508: Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Essential Addons for Elementorto a version that resolves this vulnerability.Fixed in 6.8.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when Essential Addons for Elementor is installed at a version before 6.8.7 and both administrator approval for registration and the email one-time-password registration flow are enabled.
What does an attacker need to exploit the issue?
An attacker does not need authentication, user interaction, or special privileges. They can register through the email OTP flow and log in without administrator approval when the affected features are enabled.
What is the recommended remediation?
Update Essential Addons for Elementor to version 6.8.7 or later. If updating cannot happen immediately, disable either the administrator-approval registration requirement or the email OTP registration flow so the vulnerable feature combination is not enabled.