EUVD-2026-53961
GHSA-4gxr-7mj9-rhj3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable form endpoint, no credentials required, no user interaction; impact is solely low integrity - no data disclosure or availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
AnalysisAI
CAPTCHA bypass in Element Pack Elementor Addons (WordPress plugin by BDThemes) versions up to and including 8.7.13 allows unauthenticated remote attackers to circumvent CAPTCHA verification on protected forms. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables automated or scripted clients to submit forms without completing the CAPTCHA challenge, undermining bot-protection controls. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this Medium (5.3) with integrity-only impact.
Technical ContextAI
Element Pack Elementor Addons is a third-party WordPress plugin developed by BDThemes that extends the Elementor page builder with additional widgets, including form components protected by CAPTCHA. The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), indicating the plugin's server-side CAPTCHA validation logic can be bypassed - likely by manipulating or omitting expected verification tokens or by spoofing a passing verification state. The affected CPE is cpe:2.3:a:bdthemes:element_pack_elementor_addons:*:*:*:*:*:*:*:* covering all tracked versions through 8.7.13. Because the flaw is in application-layer form validation rather than a network protocol, exploitation requires no special network position.
RemediationAI
The primary remediation is to update Element Pack Elementor Addons to a version beyond 8.7.13; the exact patched release version is not independently confirmed in the available data - consult the Patchstack advisory and the BDThemes plugin changelog on WordPress.org or the plugin's official site to identify the precise fixed version. As a compensating control while patching, site administrators can disable any form widgets that rely on the plugin's CAPTCHA feature and substitute an alternative CAPTCHA solution such as Google reCAPTCHA v3 or Cloudflare Turnstile implemented via a separate plugin. Additionally, enabling server-side rate limiting on form submission endpoints (via a WAF or hosting-level rules) reduces the practical impact of the bypass by constraining automated submission volume. The Patchstack advisory is the authoritative source for patch details: https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-8-7-13-captcha-bypass-vulnerability.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today