Essential Addons for Elementor CVE-2026-15155

Exploitation requires an authenticated account at Contributor level or above on the target WordPress site, and the site must have the plugin's Login/Register widget deployed such that the vulnerable email-header setting is reachable and used to build outgoing mail. The attacker must be able to set/persist the CRLF-laden value in that Login/Register widget setting (the allowed-values restriction exists only in the client-side editor, so it can be bypassed by submitting crafted values directly to the server) and then cause the administrator password-reset notification email to be generated. Limiting factors: it is NOT unauthenticated (PR:L requires a valid Contributor+ account), it depends on the Login/Register widget being present, and single-administrator sites without any lower-privileged accounts have no attacker principal to abuse; no user interaction by the victim is required beyond the reset email being sent.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: network-reachable, low complexity, requires only low privileges (Contributor), no user interaction, and yields full confidentiality/integrity/availability impact via administrator takeover. There is genuine tension worth flagging - the outcome is total site compromise (admin control), yet exploitation is gated behind an existing authenticated account with content-authoring rights, so this is not an unauthenticated internet-wide threat. No EPSS score was supplied, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC was provided either. The realistic priority is high for any multi-author WordPress site (blogs, membership sites, agencies) where Contributor accounts are routinely granted, and lower for single-admin installations where no low-privileged accounts exist to abuse. SSVC-style read: exploitation=none observed, technical impact=total, automatable=no (needs a valid low-priv account and the widget deployed).

An attacker who holds (or registers/obtains) a Contributor account edits or supplies the Login/Register widget's email-header-related setting, embedding CRLF sequences that append a Bcc header pointing to their own mailbox. They then trigger the WordPress administrator's password-reset notification so the reset email is silently copied to them, follow the valid reset link, set a new admin password, and take over the site. No public POC was provided, but the network vector and low attack complexity make the technique straightforward once a low-privileged account is available.