CVE-2023-41955 is a high severity (CVSS 8.8) privilege escalation flaw in Essential Addons for Elementor from WPDeveloper, in versions through 5.8.8. The Patchstack page named in the record could not be read, so the fixed version is unconfirmed here. Update to the latest release and check the advisory.
What's affected
The NVD record says Essential Addons for Elementor (the lite edition) is affected "from n/a through 5.8.8". The Patchstack URL in the record describes it as a contributor privilege escalation vulnerability, which suggests a low privileged contributor account is the starting point.
Patchstack refused our automated request, so we could not confirm the fixed version from the advisory. Treat anything at or below 5.8.8 as affected and move to the newest release, then check the advisory for the exact fixed number.
The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires low privileges, and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-269 (improper privilege management). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get essential-addons-for-elementor-lite --fields=name,status,version
Or open Plugins in the dashboard and read the version under Essential Addons for Elementor. Anything at or below 5.8.8 is in the affected range. The fixed version was not confirmed; use the latest release and check the advisory. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update Essential Addons for Elementor to the latest release or later. With WP-CLI:
wp plugin update essential-addons-for-elementor-lite. - Read the Patchstack entry to confirm the exact fixed version.
- Review users with the contributor role and above, and remove accounts that do not need to be there.
- Check the user list for recently created administrators.
Why it matters
The weakness is CWE-269, improper privilege management. The vector shows the attacker needs a low privileged account and no user interaction, and the impact on confidentiality, integrity and availability is high.
Sites that let people register as contributors or authors carry the most exposure, because the starting account is easy to obtain. Tightening who can register is a useful control while you patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2023-41955?
We could not read the advisory, so we cannot confirm it. The record says 5.8.8 and earlier are affected, so use a newer release and check the advisory.
What account does an attacker need?
The Patchstack URL names a contributor role, and the vector says low privileges are required.
Sources
- Patchstack entry for Essential Addons for Elementor 5.8.8 (linked from the record; access was blocked when we reviewed it)
- CVE-2023-41955 on Gold
Last reviewed: 19 October 2026.
