Threats tagged 'ghsa-g69p-96gc-gv86'

The Essential Addons for Elementor WordPress plugin versions before 6.8.8 improperly restrict which users can assign roles to accounts created via its registration form. Authenticated users with Author-level access or higher can escalate the roles of newly registered accounts, including those created by unauthenticated visitors, to higher privileges such as Editor. This issue is a partial regression of CVE-2026-5193, as the role-validation controls introduced in version 6.6.0 can be bypassed by lower-privileged users, leaving versions 6.6.0 through 6.8.7 vulnerable.