---
id: CVE-2026-110537
title: >-
  Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State
  Change via Bulk Action
summary: >-
  The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not
  verify that an administrator may manage the specific user accounts targeted by
  its login-approval feature, checking only a site-level capability, which on
  WordPre…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L'
cvssSource: adp
cwe:
  - CWE-863
product: Essential Addons for Elementor
affected:
  - essential_addons_for_elementor < 6.8.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T10:45:19.107904Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T10:45:23.053Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110537'
references:
  - url: 'https://wpscan.com/vulnerability/672ddaeb-b42f-4b8b-83ce-83e15899d651/'
tags:
  - cve.org
ingestedAt: '2026-10-23T06:17:25.173Z'
---

## Overview

The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

## Affected

- `essential_addons_for_elementor < 6.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.