Essential Addons for Elementor <= 6.7.1 - Unauthenticated Privilege Escalation

The Essential Addons for Elementor plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.1. This is due to missing validation against reserved wp_insert_user() data keys (such as 'role') when building the custom profile fields array, allowing user-controlled field labels to overwrite core user properties via mass assignment. This makes it possible for unauthenticated attackers to register as a new user with an arbitrary role, including administrator, by submitting a custom profile field whose label slugifies to 'role' (or another reserved wp_insert_user key), causing the value to be passed directly to wp_insert_user().

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Essential Addons for Elementor 6.7.2 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts