CVE-2026-56028: WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the Easy Elements for Elementor plugin (Addons and Website Templates) by themewant, versions 1.4.9 and earlier. The vulnerability is reachable over the network with no authentication or user interaction required, making it trivially exploitable by any remote attacker. Successful exploitation allows an attacker to escalate their privileges on the WordPress site, enabling full administrative control, arbitrary content modification, and access to all stored data. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress service via HTTP or HTTPS from any remote location.

• AuthenticationNot required

  No account or session credentials of any kind are needed; the privilege escalation path is fully accessible to unauthenticated requests.

• Victim interactionNot required

  The attack completes without any action from an existing user or administrator of the site.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental dependencies beyond network access.

Blast Radius

• An attacker gains elevated, likely administrative, privileges on the WordPress site without holding any prior account.
• With administrative access, the attacker reads all stored site data including user credentials, session tokens, personal information, and any private content.
• The attacker can modify or delete all persisted posts, pages, plugin settings, and database rows controlled by WordPress.
• Full administrative control allows the attacker to install arbitrary plugins or themes, enabling further code execution within the hosting environment.