CVE-2026-110537 Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-110537?
CVE-2026-110537 is a low-severity vulnerability in Unknown Essential Addons for Elementor, published on 23 Oct 2026.
Official description
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.
Weakness: CWE-863
Which versions are affected by CVE-2026-110537?
How do I fix CVE-2026-110537?
No fix has been published for CVE-2026-110537 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110537 being exploited?
There is no known exploitation of CVE-2026-110537 in the wild and no public exploit code.
Sources
Also known as GHSA-rhrq-vr3g-vpch.