CVE-2026-18039

{
  "etk_id": "ETK-2026-1559",
  "cve_id": "CVE-2026-18039",
  "display_id": "CVE-2026-18039",
  "ghsa_id": "GHSA-69j3-r66p-rg4r",
  "euvd_id": "EUVD-2026-58598",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Privilege escalation through registration fields in Essential Addons",
  "summary": "Essential Addons for Elementor versions before 6.7.2 can allow unauthenticated users to create accounts with roles they should not control, potentially including administrator. Exposure requires the site to have a custom profile field configured with the affected label.",
  "mitigation": "Update Essential Addons for Elementor to version 6.7.2 or later. Until the update is applied, remove or disable affected custom registration profile fields and review recently created accounts and assigned roles.",
  "vendor": "WPDeveloper",
  "product": "essential_addons_for_elementor",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.8.6, < 6.7.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.7.2"
      ],
      "package_name": "Essential Addons for Elementor",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0038,
  "epss_percentile": 0.3095,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 30.653096416666667,
  "t0_at": "2026-08-14T06:00:11.664000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-14T11:36:23.851266+00:00",
      "days": 61.23347438965278,
      "is_lower_bound": false,
      "measured_at": "2026-08-14T06:00:11.664000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 60,
      "is_lower_bound": false,
      "measured_at": "2026-08-14T06:00:11.664000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-18039"
    },
    "public_poc": {
      "at": "2026-08-14T06:00:11.664000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-08-14T06:00:11.664000+00:00",
      "url": "https://wpscan.com/vulnerability/2982ee81-3a85-435b-8347-a7848e99f373/"
    },
    "trigger_signal": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 59.749865,
      "is_lower_bound": false,
      "measured_at": "2026-08-14T06:00:11.664000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-18039"
    }
  }
}