Is CVE-2026-15155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15155 being exploited in the wild.

How severe is CVE-2026-15155?

High severity, with a CVSS score of 8.8, published 11 July 2026.

Which products and versions are affected?

WPDeveloper Essential Addons for Elementor up to, and including, 6.6.10.

Is there a fix for CVE-2026-15155?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15155 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15155?

Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15155: WPDeveloper Essential Addons for Elementor email header injection

CVE-2026-15155 · Severity: high · CVSS 8.8 · Published 2026-07-11

A popular WordPress plugin used for website design is vulnerable to a security flaw that allows low-level users to take over administrator accounts. By exploiting a weakness in how the plugin handles email notifications, an attacker can intercept password reset links intended for site administrators. This could lead to a total loss of control over the website and unauthorized access to sensitive data.

Technologies: WPDeveloper Essential Addons for Elementor. Vendors: WPDeveloper.

Quick answers

Is CVE-2026-15155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15155 being exploited in the wild.
How severe is CVE-2026-15155?: High severity, with a CVSS score of 8.8, published 11 July 2026.
Which products and versions are affected?: WPDeveloper Essential Addons for Elementor up to, and including, 6.6.10.
Is there a fix for CVE-2026-15155?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15155 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15155?: Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Email Header Injection (CWE-640) within the Login/Register widget of the Essential Addons for Elementor plugin. The root cause is insufficient server-side validation and sanitization of widget settings used to construct outgoing email headers; specifically, the plugin fails to strip or encode Carriage Return/Line Feed (CRLF) characters. An authenticated attacker with Contributor-level permissions or higher can inject a 'Bcc' header into the administrator's password-reset notification. This allows the attacker to receive a copy of the valid reset link, leading to full account takeover. The issue is addressed in version 6.6.11.

Affected products

wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets up to, and including, 6.6.10

Timeline

2026-07-11: advisory: NVD publication date
2026-07-11: disclosed: Wordfence disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.