CVE-2026-7284 is a critical vulnerability in the Easy Elements for Elementor – Addons & Website Templates plugin for WordPress. The issue stems from improper privilege management (CWE-269) in the 'easyel_handle_register' function, which fails to restrict user roles during registration. As a result, attackers can supply the 'administrator' role when registering, escalating their privileges to full admin access. This vulnerability affects all plugin versions up to and including 1.4.4 and has a CVSS 3.1 base score of 9.8, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to register as administrators on the affected WordPress site, granting them full control. This includes the ability to modify site content, install malicious plugins or themes, access sensitive data, and disrupt site availability. The vulnerability severely compromises the security and integrity of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released, it is recommended to disable or restrict user registration on the affected plugin or site. Monitor for any updates from the vendor or plugin maintainers and apply official patches promptly once available.