What is the CVSS score of EUVD-2026-51720?

EUVD-2026-51720 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of DynamicKit for Elementor are affected by EUVD-2026-51720?

DynamicKit for Elementor WordPress plugin (versions before 1.0.3) contains a vulnerability that allows attackers to steal account credentials through compromised password reset notifications.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51720?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51720. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-51720?

Within 24 hours, inventory all WordPress installations to identify which ones are running DynamicKit for Elementor and in which versions. If version 1.0.3 or later is present, no action is needed; otherwise, immediately disable the plugin to remove attack surface. Within 7 days, update all affected WordPress sites to DynamicKit for Elementor version 1.0.3 or later via the standard WordPress plugin update mechanism (Plugins > Installed Plugins > DynamicKit for Elementor > Update) or uninstall the plugin if updating is not feasible. Within 30 days, audit WordPress user accounts for signs of malicious password reset activity or unauthorized access during the exposure window, and force password resets for any compromised accounts identified.

DynamicKit for Elementor EUVD-2026-51720

| CVE-2026-14596 HIGH

Improper Authentication (CWE-287)

2026-08-01 WPScan

GHSA-wrwc-chj8-j397

WordPress Authentication Bypass Dynamickit For Elementor Unknown

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable reset endpoint requires no privileges, but full account takeover impact and mandatory victim click (UI:R) justify all-High C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:37 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 01, 2026 - 06:00 cve.org

HIGH 8.8

DescriptionCVE.org

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.

AnalysisAI

Password reset link host poisoning in DynamicKit for Elementor WordPress plugin (versions before 1.0.3) enables unauthenticated attackers to redirect victims' password reset emails to an attacker-controlled domain, carrying a valid reset key issued by the legitimate WordPress site. When the victim clicks the link, the attacker captures the reset token and achieves full account takeover. A publicly available exploit exists via WPScan, though EPSS sits at just 0.14% (4th percentile), indicating limited observed exploitation despite the severity rating and POC availability.

Technical ContextAI

The vulnerability is rooted in CWE-287 (Improper Authentication) - specifically a failure to validate the host component of a user-supplied base URL that the plugin uses when constructing password reset links. This is a variant of Host Header Injection applied to the password reset flow: the plugin trusts attacker-supplied input (likely an HTTP Host header or a URL parameter) to build the reset link, then emails it with a legitimately-issued token. The affected product is identified via CPE cpe:2.3:a:unknown:dynamickit_for_elementor:*:*:*:*:*:*:*:* and runs as an Elementor companion plugin within the WordPress ecosystem. WordPress's own core password reset is not implicated - the flaw lies in DynamicKit's custom reset implementation, which bypasses the host-binding controls that WordPress core enforces.

RemediationAI

Update DynamicKit for Elementor to version 1.0.3 or later - this is the vendor-released patch as confirmed by EUVD-2026-51720 and the WPScan advisory (https://wpscan.com/vulnerability/a23eb55c-f5b1-4dcb-8d53-6e71d80e050a/). If immediate update is not feasible, disable the plugin's custom password reset email functionality and rely on WordPress core's native reset flow, which does not inherit this flaw. As a WAF-level compensating control, implement a rule to strip or normalize the HTTP Host header on requests to the plugin's reset endpoint, preventing attacker-supplied host values from being embedded in outbound email - note this may break legitimate proxied or load-balanced configurations and requires validation against your infrastructure. Disabling the plugin entirely eliminates the attack surface with no residual risk beyond loss of the plugin's features.