Introduction
An unrestricted role parameter in a WordPress plugin's registration handler is one of the most direct paths to full site compromise. CVE-2026-7284 is that bug. In all versions through 1.4.4, the Easy Elements for Elementor plugin lets unauthenticated users register accounts with the administrator role by changing a single POST parameter.
Easy Elements for Elementor is a WordPress plugin by "themewant" that provides addons and website templates for the Elementor page builder. WPScan reports approximately 1,000 active installations. The install base is modest, but the plugin builds on Elementor (one of the most widely used WordPress page builders), and similar addon plugins are frequently deployed across that ecosystem.
Technical Information
The vulnerability is a case of CWE-269 (Improper Privilege Management) in the easyel_handle_register function, which sits in the plugin's registration widget handler at widgets/login-register/class.login-register.php. The version 1.4.0 source, available on the WordPress Plugin Repository at the trac link in the references, shows that the registration form includes a hidden input field for the user role. The backend handler reads this role value directly from the incoming POST request and passes it to the WordPress user creation process without validating it.
There is no allowlist of permitted roles, no check against the WordPress default role setting, and no restriction to stop a user from supplying a privileged role such as administrator. The server trusts the client to provide a safe role value, which is an access control failure at the most basic level.
Attack Flow
- An attacker locates a WordPress site running Easy Elements for Elementor version 1.4.4 or earlier. The site must expose a registration form powered by the plugin's login/register widget.
- The attacker inspects the registration form and finds the hidden input field that carries the role parameter, or skips the form and sends a POST request directly to the plugin's registration endpoint.
- The attacker sets the role parameter value to
administratorin the request body. - The
easyel_handle_registerfunction processes the request. Because it does not validate or restrict the role value, it creates a new WordPress user account with full administrator privileges. - The attacker logs in with the new administrator account and has complete control over the WordPress installation.
The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, for a score of 9.8. Each part of the vector points the same way: the attack works over the network, has low complexity, needs no privileges and no user interaction, and has high impact on confidentiality, integrity, and availability.
Version 1.4.5 contains the fix. Changeset 3534530 on the WordPress Plugin Repository modifies the nonce handling and the form inputs related to the role parameter, so user-controlled input can no longer dictate the assigned role during registration.
Affected Systems and Versions
- Easy Elements for Elementor versions 1.4.4 and all earlier versions (confirmed by both Wordfence and WPScan)
- The plugin requires PHP 7.4 or higher and WordPress 6.3 or higher, so any WordPress installation that meets those requirements and runs a vulnerable plugin version is at risk
- Version 1.4.5 contains the fix and is the minimum safe version
Vendor Security History
The Easy Elements for Elementor plugin has a limited security track record. WPScan lists only one recorded vulnerability for this plugin, and it is CVE-2026-7284 itself. Patchstack notes that the plugin has no Vulnerability Disclosure Program (VDP), which means the vendor has no formal channel for security researchers to report issues. A critical access control flaw in a core registration function, together with the absence of a VDP, suggests that security review has not been a priority in the plugin's development.
