{"id":"CVE-2026-110537","revision":"e3f5ae4093184d15ba21a63c6a6c3dc1","records":[{"revision":"e3f5ae4093184d15ba21a63c6a6c3dc1","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-110537","aliases":[],"title":"Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action","description":"The Essential Addons for Elementor  WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.","state":0,"publishedAt":"2026-10-23T06:00:18.451+00:00","modifiedAt":"2026-10-23T10:45:23.053+00:00","affected":[{"ecosystem":"Vendor product","name":"Essential Addons for Elementor","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Essential Addons for Elementor\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8.7\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/672ddaeb-b42f-4b8b-83ce-83e15899d651/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110537","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110537","identifiers":["CVE-2026-110537"]},"retained":false,"historicalAffected":[]}],"coverage":[]}