The Easy Elements for Elementor plugin contains a function that handles user registration without validating the role supplied by the client. An attacker can submit a registration request with the role set to "administrator" and create an admin user without authentication. This allows the attacker to gain full administrative privileges on the WordPress site, thereby compromising confidentiality, integrity, and availability of the entire site and all its data. The weakness is a classic role‑based access control flaw classified as CWE‑269.

This vulnerability affects the WordPress plugin "Easy Elements for Elementor – Addons & Website Templates" version 1.4.4 and all earlier releases. Any WordPress site installing a vulnerable version of this plugin is at risk.

The CVSS score of 9.8 indicates a critical severity. Although no EPSS value is published, the lack of a KEV listing does not reduce the likelihood of exploitation; unauthenticated users can trigger the flaw via the public registration endpoint. Based on the description, the attack vector is remote, unauthenticated, over the web interface. The attacker would need only the ability to access the WordPress site and submit the registration form with a crafted role parameter.