Users who can edit pages with Elementor, such as contributors, can add a Login/Register form whose new-user role is set to Administrator, then register through it and get an administrator account. Essential Addons for Elementor 4.6.4 and older are affected.
This vulnerability affects the following application versions:
- Essential Addons for Elementor 4.2.3
- Essential Addons for Elementor 4.2.4
- Essential Addons for Elementor 4.3.0
- Essential Addons for Elementor 4.3.1
- Essential Addons for Elementor 4.3.2
- Essential Addons for Elementor 4.3.3
- Essential Addons for Elementor 4.3.4
- Essential Addons for Elementor 4.3.5
- Essential Addons for Elementor 4.3.6
- Essential Addons for Elementor 4.3.7
- Essential Addons for Elementor 4.3.8
- Essential Addons for Elementor 4.3.9
- Essential Addons for Elementor 4.4.0
- Essential Addons for Elementor 4.4.1
- Essential Addons for Elementor 4.5.0
- Essential Addons for Elementor 4.5.1
- Essential Addons for Elementor 4.5.2
- Essential Addons for Elementor 4.5.3
- Essential Addons for Elementor 4.5.4
- Essential Addons for Elementor 4.5.5
- Essential Addons for Elementor 4.6.0
- Essential Addons for Elementor 4.6.1
- Essential Addons for Elementor 4.6.2
- Essential Addons for Elementor 4.6.3
- Essential Addons for Elementor 4.6.4