CVE-2026-18039

The Essential Addons for Elementor WordPress plugin has a vulnerability that allows an attacker to create a new account with any role, including administrator, on a site that uses a custom profile field with a specific label. This is because the plugin does not properly validate user-input data, allowing an attacker to overwrite reserved account attributes. As a result, an unauthenticated attacker can exploit this weakness to gain elevated privileges on the site.

Based on public CVE data (MITRE/NVD).