---
id: CVE-2026-110508
title: >-
  Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration
  Approval Bypass via OTP Verification
summary: >-
  The Essential Addons for Elementor WordPress plugin before 6.8.7 does not
  apply its administrator approval requirement to accounts registered through
  its email one-time-password flow, which could allow unauthenticated users to
  register a…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
product: Essential Addons for Elementor
affected:
  - essential_addons_for_elementor >= 6.7.3 < 6.8.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:36:51.371547Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:47:59.601Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110508'
references:
  - url: 'https://wpscan.com/vulnerability/77c4b22a-b1c2-4b65-b98c-e07489f94864/'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.351Z'
---

## Overview

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.

## Affected

- `essential_addons_for_elementor >= 6.7.3 < 6.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.