CVE-2026-7284criticalCWE-269

CVE-2026-7284: falha crítica em themewant Easy Elements for Elementor – Addons…

Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register

Publicada em

Seguir esta CVE+ Monitorar Easy Elements for Elementor – Addons & Website Templates

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.5%
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
themewant · Easy Elements for Elementor – Addons & Website Templates
CVEs relacionadas — themewant Easy Elements for Elementor – Addons…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-9018HIGHEasy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' ParameterEPSS 0.7%