CVE-2026-9018 is a privilege escalation vulnerability in the Easy Elements for Elementor – Addons & Website Templates WordPress plugin (up to version 1.4.5). The vulnerability arises from the `easyel_handle_register()` function, which processes the `wp_ajax_nopriv_eel_register` AJAX request. It iterates over the attacker-controlled `custom_meta` POST array and writes each key-value pair to the new user's metadata using `update_user_meta()` without any whitelist or blocklist filtering. This allows an attacker to overwrite the `wp_capabilities` meta key after the user is created, effectively assigning administrator privileges to the new account. Successful exploitation requires that user registration is enabled on the WordPress site and that the Login/Register widget is present on at least one page to expose the necessary nonce token. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8 (Network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality, integrity, and availability impacts). There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can create a new user account with full administrator privileges on a vulnerable WordPress site. This allows complete control over the site, including the ability to modify content, install plugins or themes, and potentially compromise the entire hosting environment. The impact affects confidentiality, integrity, and availability of the affected system. Exploitation requires user registration to be enabled and the presence of the Login/Register widget exposing the nonce, which may limit exposure to some sites but remains a critical risk for those configured accordingly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling user registration on the affected WordPress site if it is not required. Additionally, removing or restricting access to the Login/Register widget that exposes the `easy_elements_nonce` can reduce the attack surface. Monitoring for plugin updates from themewant is recommended to apply any forthcoming official patches promptly.