Junglewise Threat Intelligence

CVE-2026-15155: WPDeveloper Essential Addons for Elementor email header injection

CVE-2026-15155 · Severity: high · CVSS 8.8 · Published 2026-07-11

Technologies: Wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets, WPDeveloper Essential Addons for Elementor. Vendors: WPDeveloper.

Executive brief

A popular WordPress plugin used for website design is vulnerable to a security flaw that allows low-level users to take over administrator accounts. By exploiting a weakness in how the plugin handles email notifications, an attacker can intercept password reset links intended for site administrators. This could lead to a total loss of control over the website and unauthorized access to sensitive data.

Technical details

The vulnerability is an Email Header Injection (CWE-640) within the Login/Register widget of the Essential Addons for Elementor plugin. The root cause is insufficient server-side validation and sanitization of widget settings used to construct outgoing email headers; specifically, the plugin fails to strip or encode Carriage Return/Line Feed (CRLF) characters. An authenticated attacker with Contributor-level permissions or higher can inject a 'Bcc' header into the administrator's password-reset notification. This allows the attacker to receive a copy of the valid reset link, leading to full account takeover. The issue is addressed in version 6.6.11.

Affected products

  • wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets up to, and including, 6.6.10

Timeline

  • 2026-07-11: advisory: NVD publication date
  • 2026-07-11: disclosed: Wordfence disclosure date

References

Related threats