What’s Vulnerable › Vulnerabilities

CVE-2026-0673: Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-06 · updated 2026-08-12
• Weakness: CWE-93

Description

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

Affected products

• bdthemes Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons: through 8.3.15

References

• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.3.16/modules/contact-form/module.php?marks=209#L209
• https://www.wordfence.com/threat-intel/vulnerabilities/id/941d0647-5027-4642-88fc-3ab26acbb639?source=cve

Get alerted when CVE-2026-0673 or the next vulnerability affects your stack