CVE-2026-110537: Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action

Q: Who is exposed to this issue?

WordPress Multisite deployments using Essential Addons for Elementor before 6.8.7 are exposed where subsite administrators can access the plugin's login-approval bulk action. The issue concerns accounts belonging to other sites in the same network.

Q: What access does an attacker need?

An attacker needs administrator-level access on a subsite. The vulnerable check verifies a site-level capability but does not verify whether that administrator is permitted to manage each targeted user account.

Q: Are single-site WordPress installations affected in the same way?

The described cross-site impact is specific to WordPress Multisite, where user accounts can belong to different sites in a network. The provided information does not establish the same impact for single-site installations.

Q: What is the remediation?

Update Essential Addons for Elementor to version 6.8.7 or later. If updating cannot happen immediately, restrict untrusted subsite administrator access to the plugin's login-approval functionality.

Published Oct 23, 2026

Updated

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

Affected Software

1 affected component

WPDeveloper Essential Addons for Elementor<6.8.7

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress Multisite deployments using Essential Addons for Elementor before 6.8.7 are exposed where subsite administrators can access the plugin's login-approval bulk action. The issue concerns accounts belonging to other sites in the same network.

What access does an attacker need?

An attacker needs administrator-level access on a subsite. The vulnerable check verifies a site-level capability but does not verify whether that administrator is permitted to manage each targeted user account.

Are single-site WordPress installations affected in the same way?

The described cross-site impact is specific to WordPress Multisite, where user accounts can belong to different sites in a network. The provided information does not establish the same impact for single-site installations.

What is the remediation?

Update Essential Addons for Elementor to version 6.8.7 or later. If updating cannot happen immediately, restrict untrusted subsite administrator access to the plugin's login-approval functionality.

CVE-2026-110537: Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

Are single-site WordPress installations affected in the same way?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

Are single-site WordPress installations affected in the same way?

What is the remediation?