The vulnerability exists in the Essential Addons for Elementor WordPress plugin before version 6.8.7. It occurs because the plugin does not verify that an administrator has permission over the specific user accounts it targets. As a result, a subsite administrator on a WordPress Multisite network can change the login‑approval state of any user account belonging to another subsite. This improper access control (CWE-863) can lead to unauthorized access or denial of service for users in other subsites.

Essential Addons for Elementor WordPress plugin, all releases prior to 6.8.7. The issue is relevant to any WordPress Multisite network where subsite administrators are granted the plugin's bulk‑action capability. The vulnerability affects only the plugin and the WordPress Multisite environment, not the core WordPress installation itself.

The flaw is limited to users who already hold subsite‑administrator privileges, so an external attacker cannot directly exploit it without first gaining such a role. The CVSS score of 3.8 reflects a low‑to‑moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to be a subsite administrator and to use the plugin’s bulk‑action feature to alter user approval states on other subsites. The lack of capability checks therefore constitutes a moderate privilege‑escalation risk within a multisite deployment.