EUVD-2026-53870
GHSA-74gv-xjcv-gwc2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible unauthenticated AJAX endpoint with CRLF injection limited to email header manipulation; no confidentiality or availability impact applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the element_pack_contact_form AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.
AnalysisAI
Email header injection in Element Pack Addons for Elementor (versions up to and including 8.3.15) allows unauthenticated network attackers to append arbitrary headers to contact form emails by submitting newline characters via the element_pack_contact_form AJAX action. Insufficient sanitization of CRLF sequences in user-supplied input enables header manipulation - enabling BCC/CC abuse, From spoofing, or use of the site as a spam relay. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV; however, exploitation requires no authentication and trivial technical skill, making opportunistic mass abuse realistic against any unpatched installation.
Technical ContextAI
CWE-93 (Improper Neutralization of Special Characters) describes vulnerabilities where CRLF sequences (\r\n) inserted into header fields allow attackers to terminate one header line and inject additional lines. In email contexts, SMTP headers are newline-delimited, so unsanitized user input concatenated directly into To:, From:, CC:, or Subject: fields allows arbitrary header insertion. The affected code path is the element_pack_contact_form WordPress AJAX action in the BDThemes Element Pack plugin (CPE: cpe:2.3:a:bdthemes:element_pack_addons_for_elementor_-_elementor_widgets,_elementor_templates,_elementor_addons:*:*:*:*:*:*:*:*). The patch is visible in plugin trac at version 8.3.16, specifically in modules/contact-form/module.php at line 209, where sanitization of newline characters was added.
RemediationAI
Update the Element Pack Addons for Elementor plugin to version 8.3.16 or later; the patched code is confirmed available in the WordPress plugin repository and addresses newline character sanitization in module.php at line 209. If immediate upgrade is not possible, the most targeted compensating control is to disable or unpublish any pages using the Element Pack contact form widget to remove the publicly accessible AJAX endpoint - this eliminates the attack surface entirely with no other functionality impact. Alternatively, a WAF rule blocking CRLF sequences (literal \r\n or URL-encoded %0d%0a and %0a) in POST body parameters destined for the WordPress AJAX handler (wp-admin/admin-ajax.php with action=element_pack_contact_form) can block exploitation without disabling the form, though WAF rules require ongoing maintenance. Wordfence's threat intelligence entry is available at wordfence.com/threat-intel/vulnerabilities/id/941d0647-5027-4642-88fc-3ab26acbb639.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today