Elementor Plugin Allows Privilege Escalation via Registration Fields

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Essential Addons for Elementor WordPress plugin before version 6.7.2 contains a critical privilege escalation vulnerability where custom registration fields can overwrite reserved WordPress user attributes. Specifically, unauthenticated attackers can manipulate user-supplied registration data to assign arbitrary roles—including administrator—during account creation. This vulnerability is particularly dangerous because it requires no prior authentication and affects WordPress sites using Elementor with custom profile field configurations. Organizations running vulnerable versions face immediate risk of unauthorized administrative access, complete site compromise, and potential data theft or malware deployment.

Casky's 224 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns behind TA0004 (Privilege Escalation) techniques. Practitioners using Casky would identify suspicious registration requests that attempt to inject role attributes (such as 'wp_user_level' or 'wp_capabilities') through custom field parameters. The platform's skills would flag anomalous POST requests to registration endpoints containing field values that don't match expected patterns, detect successful account creation with elevated privileges when none should exist, and correlate registration field names with WordPress reserved attributes. Security teams would see findings highlighting the gap between intended field functionality and actual attribute assignment, enabling rapid detection of exploitation attempts before attackers establish persistent administrative access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18039.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-18039

Casky has 224 skills that investigate the attack patterns behind CVE-2026-18039. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn