The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin contains a register_user function that only blocks the administrator role when creating new accounts. Because the code does not verify the caller’s role beyond that, a user who has author or higher access can use the function to create new accounts that are granted editor privileges. The resulting elevation of privilege allows the attacker to perform editor‑level actions, such as editing posts and publishing content, thus potentially compromising the confidentiality, integrity, and availability of the WordPress site.

All releases of the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin up to and including version 6.5.13 installed on a WordPress site are affected.

The flaw is exploitable only by users who already possess authenticated author or higher roles, which means the attack vector is internal and requires legitimate credentials. The vulnerability’s CVSS score of 6.5 indicates moderate severity, and its EPSS score is not reported, indicating no current exploitation data. The issue is not listed in the CISA KEV catalog. Consequently, the primary risk is that any existing author or editor account can abuse the register_user function to elevate privileges to editor level, enabling further malicious activity on the site.