Login and Register Security Guard Bypass in Essential Addons for Elementor

Every security guard in the Login/Register widget — nonce verification, reCAPTCHA, Cloudflare Turnstile and the OTP gate — only terminated the request inside a branch that required the client-supplied Referer header. Omitting that header made a failed check fall through into the login, registration and password-reset logic instead of aborting,...