CVE-2026-18039: 
WordPress vulnerability analysis and mitigation

CVE-2026-18039 is an unauthenticated privilege escalation vulnerability in the Essential Addons for Elementor WordPress plugin, classified as "Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment." It affects plugin versions from 5.8.6 up to (but not including) 6.7.2, and was publicly disclosed on August 12–14, 2026. The flaw allows unauthenticated attackers to register a WordPress account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured. It carries a CVSS v3.1 base score of 8.1 (High) (WPScan, GitHub Advisory).

The root cause is improper privilege management (CWE-269), specifically a mass assignment weakness where user-supplied registration form fields are not sanitized or restricted from overwriting reserved WordPress account attributes such as the user role. When a site administrator has configured a custom profile field with a particular label (as part of the plugin's registration widget), an attacker can include a role or equivalent reserved parameter in the registration request, causing the plugin to assign an arbitrary role — including administrator — to the newly created account. This is a network-based attack requiring no authentication or user interaction, though it does require the specific custom profile field configuration to be present (Attack Complexity: High). The PoC is scheduled for public release on September 12, 2026, per WPScan's coordinated disclosure policy (WPScan, GitHub Advisory).

Successful exploitation grants an unauthenticated attacker full administrative control over the affected WordPress installation. With administrator-level access, an attacker can install malicious plugins or themes, exfiltrate sensitive data (user credentials, personal information, payment data), deface the site, establish persistent backdoors, or pivot to the underlying server infrastructure. The confidentiality, integrity, and availability impacts are all rated High (WPScan, GitHub Advisory).

No public proof-of-concept exploit is currently available; WPScan has withheld the PoC until September 12, 2026, to allow time for patching. There is no evidence of active in-the-wild exploitation at this time, and CISA's SSVC assessment classifies exploitation as "none" and the attack as not automatable. The EPSS score is approximately 0.146–0.279%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, GitHub Advisory, Feedly).

1. Reconnaissance: Identify WordPress sites using the Essential Addons for Elementor plugin (versions 5.8.6–6.7.2) with a user registration form enabled. Tools like WPScan, Shodan, or manual inspection of page source can reveal plugin usage.
2. Identify vulnerable configuration: Confirm that the target site has configured a custom profile field with the specific label that triggers the mass assignment vulnerability (e.g., a field labeled role or a reserved WordPress user attribute name).
3. Craft malicious registration request: Submit a registration form request (HTTP POST) to the site's registration endpoint, including a user-supplied field that maps to a reserved WordPress account attribute such as role, with the value set to administrator.
4. Account creation with elevated role: The plugin processes the registration without filtering the reserved attribute, resulting in the creation of a new WordPress user account with the administrator role.
5. Authenticate and take control: Log in with the newly created administrator account and perform any desired actions, including installing backdoors, exfiltrating data, or modifying site content (WPScan).

• Logs: WordPress authentication logs (wp-login.php access logs) showing new account registrations followed immediately by administrator-level actions; unexpected new administrator accounts in wp_users / wp_usermeta tables with wp_capabilities set to administrator.
• File System: Newly installed plugins or themes not authorized by legitimate administrators; presence of web shells or backdoor files in the WordPress uploads or plugins directories.
• Network: Unusual POST requests to the site's registration endpoint (e.g., /wp-admin/admin-ajax.php or the page hosting the Essential Addons registration widget) containing unexpected field names such as role or other reserved WordPress user attributes.
• Process/Behavior: Unexpected administrator accounts appearing in the WordPress dashboard (/wp-admin/users.php) with recent registration timestamps; plugin or theme installations occurring outside normal maintenance windows.

Update the Essential Addons for Elementor plugin to version 6.7.2 or later, which resolves the mass assignment vulnerability by preventing user-supplied fields from overwriting reserved account attributes. As an interim workaround, site administrators should disable user registration functionality if it is not essential, or remove any custom profile fields configured with labels that map to reserved WordPress account attributes. Additionally, review the WordPress user list for any unauthorized administrator accounts and remove them immediately (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Jakub Herman (jakubherman.net) and submitted to WPScan, which coordinated disclosure and is withholding the PoC until September 12, 2026. The issue was noted on Mastodon/infosec.exchange by the Offseq security account shortly after publication. No major vendor statements or widespread media coverage have been identified beyond standard vulnerability database entries (WPScan).