{"id":"CVE-2026-110508","title":"Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification","summary":"The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register a…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-862"],"product":"Essential Addons for Elementor","affected":["essential_addons_for_elementor >= 6.7.3 < 6.8.7"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-28T17:36:51.371547Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:47:59.601Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110508","references":[{"url":"https://wpscan.com/vulnerability/77c4b22a-b1c2-4b65-b98c-e07489f94864/"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T11:09:40.351Z","slug":"CVE-2026-110508","body":"## Overview\n\nThe Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.\n\n## Affected\n\n- `essential_addons_for_elementor >= 6.7.3 < 6.8.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}