CVE-2023-32243: Essential Addons for Elementor improper authentication privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable privilege escalation with a CVSS of 9.8, public exploit references and a very high EPSS score makes this an urgent patch.

What it is

The WordPress plugin Essential Addons for Elementor (versions 5.4.0 through 5.7.1) contains an improper authentication flaw that allows privilege escalation. Because the flaw is unauthenticated and network-reachable, any site running an affected version is exposed to takeover by an anonymous attacker.

Impact

An attacker can escalate privileges, in practice resetting an arbitrary user's password and gaining administrative control of the WordPress site.

Attack surface

Reachable over the network via the plugin's vulnerable endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but public exploit references exist (Packet Storm and Patchstack) and EPSS is very high at 0.755 (99.5th percentile), indicating active, likely exploitation.

What to do

• Update Essential Addons for Elementor to a version later than 5.7.1 immediately.
• If patching is not possible, deactivate or remove the plugin until it can be updated.
• Audit WordPress administrator accounts and reset credentials for any accounts that may have been targeted.
• Review logs for unexpected password reset requests and new or modified admin users.
• Apply virtual patching or WAF rules blocking unauthenticated requests to the plugin's password reset functionality.

Detection

• Monitor for password reset events and admin credential changes in WordPress audit logs.
• Alert on new administrator account creation or role changes outside change windows.
• Inspect web server logs for unauthenticated POST requests to Essential Addons plugin endpoints.
• Correlate plugin file access with subsequent successful admin logins from unusual IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.