Vulnerabilities CVE-2026-0673

CVE-2026-0673

Medium

Open

TLP:CLEAR

Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

Details

CVSS Score: 5.3
EPSS Score ⓘ: 0.21%

11.4th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Confidence: 90%
Published: Aug 6, 2026
Last Modified: Aug 6, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.