CVE-2026-7284CWE-269

Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register

Critical · published May 20, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00674 · 51.6th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-05-20T01:25Z
EPSS history
Timeline
  • 20 MAY 01:25Z
    Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register
    cvelistv5