The Easy Elements for Elementor – Addons & Website Templates plugin is subject to an unauthenticated privilege escalation flaw. The wp_ajax_nopriv_eel_register AJAX handler does not whitelist the custom_meta POST array and writes each supplied key-value pair to a newly created user's meta, allowing an attacker to overwrite the wp_capabilities key and assign administrator privileges during registration.

Any WordPress site running the Easy Elements for Elementor – Addons & Website Templates plugin by themewant with a version up to and including 1.4.5 is affected.

The flaw carries a CVSS score of 8.8, indicating high severity. Because the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, the likelihood of widespread exploitation is uncertain but could be significant if the conditions are met. Attackers need user registration enabled and a page exposing the Login/Register widget that publishes the easy_elements_nonce. With the nonce in hand, an unauthenticated user can submit a specially crafted POST request to the wp_ajax_nopriv_eel_register endpoint, creating a new account with full administrator privileges.