Element Pack Addons For Elementor Elementor Widgets Elementor Templates Elementor Addons
Monthly
Email header injection in Element Pack Addons for Elementor (versions up to and including 8.3.15) allows unauthenticated network attackers to append arbitrary headers to contact form emails by submitting newline characters via the `element_pack_contact_form` AJAX action. Insufficient sanitization of CRLF sequences in user-supplied input enables header manipulation - enabling BCC/CC abuse, From spoofing, or use of the site as a spam relay. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV; however, exploitation requires no authentication and trivial technical skill, making opportunistic mass abuse realistic against any unpatched installation.
Email header injection in Element Pack Addons for Elementor (versions up to and including 8.3.15) allows unauthenticated network attackers to append arbitrary headers to contact form emails by submitting newline characters via the `element_pack_contact_form` AJAX action. Insufficient sanitization of CRLF sequences in user-supplied input enables header manipulation - enabling BCC/CC abuse, From spoofing, or use of the site as a spam relay. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV; however, exploitation requires no authentication and trivial technical skill, making opportunistic mass abuse realistic against any unpatched installation.