The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to…

CVE-2026-7284 is a WordPress plugin privilege-escalation bug in Easy Elements for Elementor – Addons & Website Templates. In versions through 1.4.4, the plugin's registration handler trusts attacker-supplied role data, so an unauthenticated visitor can register a new account as administrator and immediately own the site.

The vendor/CNA 9.8 CRITICAL score is technically defensible in a lab because the path is remote, unauthenticated, and ends in full admin. In real enterprise patch queues, though, that score overstates urgency: Wordfence showed only about 1,000 active installs, the plugin was closed on WordPress.org on 2026-05-19, there is no KEV listing or confirmed in-the-wild exploitation, and the reachable attack surface appears tied to the plugin's registration widget rather than every WordPress page.

Why this verdict

• Baseline starts severe: unauthenticated remote creation of an administrator account is direct application takeover, not a mere information leak or nuisance bug.
• Population collapses fast: Wordfence showed only about 1,000 active installs, so this is nowhere near the exposure class of a broadly deployed CMS core or edge appliance bug.
• Feature gating matters: the vulnerable path sits in the plugin's registration flow; based on the later related CVE-2026-9018 in the same function area, reachable exploitation likely assumes registration is enabled and a public Login/Register widget is exposed.
• Threat intel is cold: no KEV, no verified active exploitation in reviewed sources, and the supplied EPSS 0.00099 is very low for a supposedly urgent internet fire.

Why not higher?

I am not keeping this at CRITICAL because the raw CVSS story assumes every installed site is equally reachable from the internet, and that is not how WordPress plugin bugs work in practice. Small install base, probable widget/registration prerequisites, and no exploitation evidence all cut the operational urgency down a full notch.

Why not lower?

I am not dropping this to MEDIUM because the exploit does not require prior compromise, valid credentials, or user interaction. If your site exposes the vulnerable workflow, the attacker goes straight to administrator, and the jump from there to content abuse, secret theft, or code execution is short.

1. Disable self-service registration where you can — If the business does not need public account creation, turn off WordPress registration and remove or hide the Easy Elements Login/Register widget. This directly cuts the exploit path and should be done within 30 days for this HIGH verdict.
2. Enforce MFA on all administrator accounts — This does not fix the bug, but it can stop a freshly created rogue admin from turning into an interactive takeover if your MFA policy triggers on new privileged accounts too. Apply it within 30 days anywhere WordPress admin access is exposed.
3. Block the vulnerable registration action at the edge — Add a temporary WAF or reverse-proxy rule to challenge or block suspicious registration posts to the plugin's AJAX registration path, especially requests carrying elevated role fields. Use this as a stopgap within 30 days while patching catches up.
4. Audit for rogue admins and registration spikes — Review WordPress users, audit logs, and web logs for new privileged accounts, bursts of registration attempts, or suspicious admin-ajax.php traffic. Start immediately and keep it in place until all affected sites are remediated.

Run this on the target WordPress host or inside the container that holds the site files. Invoke it as bash check-cve-2026-7284.sh /var/www/html and pass the WordPress root path; it needs only read access to the plugin files, though sudo may be required if the webroot is not readable to your shell user.

#!/usr/bin/env bash
# check-cve-2026-7284.sh
# Detects whether a WordPress site is vulnerable to CVE-2026-7284
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

WP_ROOT="${1:-}"
PLUGIN_DIR=""
VERSION=""

if [[ -z "$WP_ROOT" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wordpress"
  exit 2
fi

if [[ ! -d "$WP_ROOT" ]]; then
  echo "UNKNOWN - path does not exist: $WP_ROOT"
  exit 2
fi

if [[ ! -f "$WP_ROOT/wp-config.php" && ! -f "$WP_ROOT/wp-load.php" ]]; then
  echo "UNKNOWN - does not look like a WordPress root: $WP_ROOT"
  exit 2
fi

PLUGIN_DIR="$WP_ROOT/wp-content/plugins/easy-elements"

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "PATCHED - easy-elements plugin not present at $PLUGIN_DIR"
  exit 0
fi

# Try readme.txt Stable tag first
if [[ -f "$PLUGIN_DIR/readme.txt" ]]; then
  VERSION=$(grep -iE '^Stable tag:' "$PLUGIN_DIR/readme.txt" | head -n1 | sed -E 's/^[Ss]table [Tt]ag:[[:space:]]*//')
fi

# Fall back to plugin header in the main PHP file
if [[ -z "$VERSION" && -f "$PLUGIN_DIR/easy-elements.php" ]]; then
  VERSION=$(grep -iE '^\s*Version:' "$PLUGIN_DIR/easy-elements.php" | head -n1 | sed -E 's/^\s*[Vv]ersion:[[:space:]]*//')
fi

# Final fallback: scan top-level PHP files for a Version header
if [[ -z "$VERSION" ]]; then
  while IFS= read -r -d '' f; do
    v=$(grep -iE '^\s*Version:' "$f" | head -n1 | sed -E 's/^\s*[Vv]ersion:[[:space:]]*//')
    if [[ -n "$v" ]]; then
      VERSION="$v"
      break
    fi
  done < <(find "$PLUGIN_DIR" -maxdepth 1 -type f -name '*.php' -print0 2>/dev/null)
fi

VERSION=$(echo "$VERSION" | tr -d '\r' | xargs)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not determine easy-elements version"
  exit 2
fi

verlte() {
  # returns 0 if $1 <= $2 using version sort
  [[ "$1" == "$2" ]] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [[ "$first" == "$1" ]]
}

if verlte "$VERSION" "1.4.4"; then
  echo "VULNERABLE - easy-elements version $VERSION <= 1.4.4"
  exit 1
fi

if [[ "$VERSION" == "1.4.5" ]]; then
  echo "PATCHED - easy-elements version 1.4.5 fixes CVE-2026-7284 (review CVE-2026-9018 separately)"
  exit 0
fi

echo "PATCHED - easy-elements version $VERSION is newer than 1.4.4"
exit 0

Sources

1. Wordfence vulnerability record for CVE-2026-7284
2. NVD entry for CVE-2026-7284
3. WPScan vulnerability entry
4. WordPress.org plugin page
5. OpenCVE record with CISA ADP enrichment
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS documentation and data notes
8. NVD entry for related follow-on flaw CVE-2026-9018