UNKNOWN NVD

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attribute

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

References

https://wpscan.com/vulnerability/2982ee81-3a85-435b-8347-a7848e99f373/

Published: 2026-08-14 · Source: NVD · Feed updated: 2026-08-14

This unknown severity vulnerability was published on 2026-08-14 via NVD.

vulnfeed aggregates 11029 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.