CVE-2021-4331

The Plus Addons for Elementor plugin contained a privilege escalation flaw affecting versions up to 4.1.9 for the pro edition and 2.0.6 for the free version. The registration form feature allowed users to specify a default role for new registrations, but this setting was not restricted to administrators, meaning contributors and other lower-level users with page builder access could change it to assign administrator privileges to newly registered accounts. While contributors could not independently publish posts to exploit this without admin approval, users with author-level permissions and above could escalate their own privileges without requiring administrator intervention.

Based on public CVE data (MITRE/NVD).