CVE-2026-9018

Vulnerability

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress versions up to and including 1.4.5 contains a privilege escalation vulnerability in the easyel_handle_register() function, exposed via the wp_ajax_nopriv_eel_register AJAX handler. The function passes user-supplied custom_meta POST array directly to update_user_meta() without any key whitelist or blocklist. This allows an attacker to overwrite the wp_capabilities user meta key after wp_insert_user() has already assigned a safe role, enabling arbitrary role assignment. The registration form must be enabled (site option users_can_register) and a page must include the Login/Register widget, which exposes the easy_elements_nonce in the DOM. [1] [2] [3] [4]

Exploitation

An unauthenticated attacker must submit a POST request to the AJAX endpoint with the required nonce and the parameter custom_meta[wp_capabilities][administrator]=1. The nonce can be retrieved from the page HTML of any site page that contains the Login/Register widget (the widget publishes the nonce in a script or element). No prior authentication or user interaction is required. The function then creates a new user with the provided credentials and immediately applies the attacker-specified wp_capabilities, granting full Administrator privileges. [2] [3] [4]

Impact

Successful exploitation results in the creation of an administrator-level account that the attacker fully controls. The attacker can then log in and gain complete control over the WordPress site, including the ability to upload files, install plugins, modify content, and execute arbitrary code. The confidentiality, integrity, and availability of the site are fully compromised. [2] [3]

Mitigation

The fixed version is not explicitly specified in the available references. As of the publication date (2026-05-22), no patch release has been announced; users should disable the Login/Register widget and consider disabling user registration until an update from the vendor is available. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.