The Essential Addons for Elementor plugin contains a flaw in its user registration logic that allows an attacker to pass a revision ID as the target page ID. Because the revision post status "inherit" is not filtered out, and the code mistakenly uses the revision's "post_author" field instead of the "_edit_last" meta field, the system treats the revision as if it were edited by an administrator. This bypasses standard ACL checks and, coupled with an ineffective nonce that can be obtained by any visitor, lets an unauthenticated user create an account with editor permissions, giving them edit_others_posts, publish_pages, upload_files, and unfiltered_html rights. The weakness is a classic example of improper authorization (CWE-269).

Any WordPress site that has the Essential Addons for Elementor plugin installed on a version 6.8.7 or earlier, and that has the "Anyone can register" setting enabled. The vulnerability also requires that an administrator has previously used the Login/Register widget to assign a non‑default user role to a page and then reverted the setting, so that the role information is stored in a page revision. If these conditions are met, the exploit can be executed on the affected installation regardless of the site’s overall configuration.

The score of 7.4 indicates a high severity assessment. Although an EPSS value is not available, the lack of a KEV listing suggests that the vulnerability has not yet been widely exploited in the wild, but the attack vector is simple: a web request can retrieve a valid nonce via the wp_ajax_nopriv_eael_get_token endpoint, and then the attacker can trigger the register_user() function with a crafted payload. Given the widespread use of the plugin and the common configuration of allowing public registration, the risk of exploitation remains significant for administrators who have not applied the vendor’s patch.