CVE-2026-5193: Privilege Escalation in Essential Addons for Elementor

The primary impact of CVE-2026-5193 is the potential for unauthorized privilege escalation within a WordPress site. An attacker, already possessing author or higher access, can exploit this vulnerability to create new user accounts with editor or administrator privileges. This grants them the ability to modify content, install plugins, change site settings, and potentially compromise the entire WordPress installation. The blast radius extends to any data accessible by users with editor or administrator roles, including sensitive information stored in the database or accessible through plugins. While not directly comparable to a remote code execution vulnerability, the ability to gain elevated privileges can be a stepping stone to further compromise.

1. Reserviert2026-03-30
2. Veröffentlicht2026-05-14

The primary mitigation for CVE-2026-5193 is to immediately upgrade the Essential Addons for Elementor plugin to version 6.6.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user creation privileges within WordPress. This can be achieved through a plugin that limits the roles available for new user registration. Additionally, review existing user accounts for any suspicious activity. After upgrading, verify the fix by attempting to create a new user account with a role other than 'subscriber' while logged in as a user with author privileges; the attempt should be rejected.