CVE-2026-25440: Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0

Technical summary

CVE-2026-25440 is an unauthenticated broken access control vulnerability (CWE-862) in Essential Addons for Elementor affecting versions below 6.6.0. The vulnerability stems from insufficient authorization validation on sensitive operations, allowing unauthenticated requests to modify data. With a CVSS 3.1 score of 5.3 (Medium), the attack vector is network-based, requires no special conditions, and involves no user interaction. The impact is limited to integrity (data modification), with no confidentiality or availability loss in the CVSS model.

Business impact

Organizations using vulnerable versions of Essential Addons for Elementor face risk of unauthorized content modification on their websites. Attackers could alter page layouts, text, forms, or linked resources without authentication, potentially damaging site credibility, injecting malicious content, or redirecting users. For e-commerce or service sites built with Elementor, unauthorized changes could disrupt customer experience or create compliance concerns. The medium severity reflects that this is primarily an integrity issue without direct data exposure or outage risk, but integrity violations can have significant downstream business consequences.

Affected systems

Essential Addons for Elementor versions below 6.6.0 are vulnerable. Organizations should audit their WordPress installations running this plugin to determine current version numbers. The plugin is widely used in WordPress page builder workflows, so exposure depends on deployment scope within your infrastructure. Verify your installed version in the WordPress admin dashboard or via direct inspection of the plugin directory.

Exploitability

This vulnerability is exploitable with minimal barriers to entry: network access only, no authentication required, and no complex interaction needed. An attacker can craft requests directly from the internet without user involvement or special privileges. The CVSS vector reflects this accessibility. However, the specific attack vector and affected endpoints are not documented in this advisory; consult the vendor's security advisory and patch release notes for technical attack surface details to inform your detection and remediation planning.

Remediation

Update Essential Addons for Elementor to version 6.6.0 or later. This version includes authorization validation fixes that prevent unauthenticated access control bypass. Plan updates during maintenance windows to avoid disrupting active site usage. Before upgrading in production, test on a staging environment to ensure compatibility with your Elementor configurations and custom workflows.

Patch guidance

Upgrade Essential Addons for Elementor to 6.6.0 or newer via the WordPress plugin dashboard, the official plugin repository, or your license portal if you use the premium version. Verify the upgrade completed successfully and the new version is active. If you manage multiple WordPress instances, prioritize production sites first. Document the patch date and version for your change management and compliance records.

Detection guidance

Monitor web server logs for anomalous requests to Elementor plugin endpoints from unauthenticated sources, particularly POST or PUT requests to data modification endpoints. Check for unexpected changes to Elementor page or widget data in your WordPress database change logs. Use WordPress security plugins that monitor unauthorized content modifications. Query your WordPress installation to identify all sites running Essential Addons for Elementor and their current versions to prioritize patching.

Why prioritize this

Although categorized as Medium severity, this vulnerability merits prompt attention because it requires no authentication and no user interaction to exploit. Any internet-facing WordPress site running a vulnerable version is at immediate risk of unauthorized content tampering. The reputational and operational impact of website defacement or content injection can be severe even if the technical CVSS score is moderate. Prioritize over lower-severity vulnerabilities affecting less accessible attack surfaces.

Risk score, explained

CVSS 3.1 score of 5.3 (Medium) reflects network accessibility and low attack complexity, balanced against the integrity-only impact scope. The attack requires no privileges or user interaction, placing it in the readily exploitable category. The score does not account for business context (site criticality, public visibility, or compliance obligations), which may elevate your organizational risk assessment above the base CVSS rating. The absence of CISA KEV listing does not indicate low risk; it reflects that active exploitation has not yet been formally documented in public campaigns.

Frequently asked questions