CVE-2026-5193: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'registeruser' function, which only blocks the 'administrator' role. This makes it possible for authenticated attackers, with author level access and above, to create new user accounts with elevated privileges such as editor.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5193?
The severity of CVE-2026-5193 is classified as a limited privilege escalation vulnerability.
How do I fix CVE-2026-5193?
To fix CVE-2026-5193, update the Essential Addons for Elementor plugin to a version greater than 6.5.13.
Who is affected by CVE-2026-5193?
Any WordPress site using the Essential Addons for Elementor plugin version 6.5.13 or lower is affected by CVE-2026-5193.
What type of vulnerability is CVE-2026-5193?
CVE-2026-5193 is a limited privilege escalation vulnerability that allows authenticated users with author privileges to gain higher permissions.
Can CVE-2026-5193 be exploited remotely?
No, CVE-2026-5193 requires authenticated users with author-level privileges to exploit the vulnerability.