CVE Roundup for July 11, 2026: Seven WordPress Plugins Enable Privilege Escalation

Shared attack chain

All seven faults use the same shape. A subscriber, contributor, or author account serves as the foothold. The attacker escalates to administrator through broken authorization, missing capability checks, or improper input handling in plugin code. Outcome: admin impersonation or arbitrary server-side execution.

One prerequisite controls exposure: the attacker must hold a login. Sites that allow public registration, or that hand contributor seats to external writers, satisfy this requirement by design. Sites that lock registration still hold the line, as long as credentials do not leak elsewhere.

This differs from CVE-2026-57807 (miniOrange), which is unauthenticated. Treat the 9.8 as instant kill. Treat the 8.8s as conditional kill — but conditional is not safe.

Scope and the 2M-site outlier

Essential Addons for Elementor is the largest in this set. Per the WordPress plugin directory, active installs exceed 2,000,000. Affected versions: 6.6.10 and prior. Root cause: CRLF injection in the outgoing mail routine. Line-break characters pass through sanitization unchecked.

Additional confirmed member: JetBlocks For Elementor (Crocoblock), tracked as CVE-2026-61976, severity MEDIUM, versions ≤ 1.5.0. Vector: unauthenticated retrieval of embedded sensitive data (CWE-497). Disclosure surfaced via Feedly on July 13, 2026.

The remaining five plugin identities were not enumerated in the source material we reviewed. Confirm installed-plugin inventory against the upstream roundup before assuming a clean baseline.

Diagnostic sequence

Run these in order. Stop at any failure and resolve before proceeding.

1. wp plugin list --allow-root --format=json | jq '.[] | {name, version, update, status}' — snapshot every plugin name, installed version, and update flag.

2. Cross-reference that list against the seven IDs in the July 11, 2026 roundup. Essential Addons for Elementor and JetBlocks For Elementor are the two confirmed entries; five others pending vendor advisory details.

3. For each match: confirm installed version is strictly greater than the fixed cutoff listed by the vendor. Patched ≠ latest. Read the changelog.

4. wp user list --role=subscriber --role=contributor --role=author --format=count — quantify low-privilege seats. Every active subscriber is a potential staging account for an attacker who phishes a credential.

5. Disable self-registration if business logic allows: Settings → General → Anyone can register = unchecked. Contributor-only intake should route through a vetted onboarding flow with MFA enforced.

6. Pull the access log filter: grep -E "wp-login|xmlrpc|admin-ajax" /var/log/nginx/access.log | awk '$9 ~ /^(401|403|429)$/' | wc -l. A spike here in the 24 hours before a CVE drops is a leading indicator.

7. Snapshot a clean backup. Restoration capability is not optional — patching under pressure is unsafe without a verified restore point.

Baseline checklist

• Plugin inventory captured and hashed. Diff against advisory list every Monday.
• All seven CVEs mapped to installed versions; patched or removed.
• Public registration closed or gated behind manual approval.
• MFA enabled on every account with edit_users capability.
• WAF rule deployed for the miniOrange endpoint until the SSO plugin is patched.
• Daily database backup verified against a test restore within the last 7 days.
• Log alerts configured for repeated 401/403 on wp-login.php from single IP.

Track vendor advisories for the five unnamed plugins as they publish full details. Essential Addons for Elementor and JetBlocks remain the two confirmed exposure points today.