CVE-2026-110537
Last modified
CVE-2026-110537 is a low-severity vulnerability rated 3.8/10 on the CVSS scale. The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network..
Description
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Essential Addons for Elementor | < 6.8.7 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-110537?
How severe is CVE-2026-110537?
How do I fix CVE-2026-110537?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110523The WP User Manager WordPress plugin before 2.9.26 does not…8.1
- CVE-2026-110524The Copy Anything to Clipboard for WordPress WordPress plug…6.8
- CVE-2026-110527The WP User Manager WordPress plugin before 2.9.20 does not…5.3
- CVE-2026-110530The FeedWordPress plugin for WordPress is vulnerable to Stor…7.2
- CVE-2026-110533The FV Flowplayer Video Player plugin for WordPress is vulne…6.4
- CVE-2026-110536A vulnerability was determined in D-Link DIR-868L 2.01b05. T…10
- CVE-2026-11054Use after free in WebRTC in Google Chrome prior to 149.0.782…8.8
- CVE-2026-110540Dell PowerProtect Data Domain Management Center, Feature Rel…7.1
- CVE-2026-110541Dell PowerProtect Data Domain, Feature Release versions 7.7.…7.2
- CVE-2026-11055Use after free in ANGLE in Google Chrome on Windows prior to…8.8
- CVE-2026-11056Insufficient validation of untrusted input in SiteIsolation …9.6
- CVE-2026-11057Uninitialized Use in Skia in Google Chrome prior to 149.0.78…6.5
Are you affected by CVE-2026-110537?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST