# CVE-2026-15155: WPDeveloper Essential Addons for Elementor email header injection

Source: https://junglewise.ai/threats/cve-2026-15155-wpdeveloper-essential-addons-for-elementor-email-header-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11. Updated: 2026-07-11  
License: CC BY 4.0 with a link back

CVE-2026-15155 · Severity: high · CVSS 8.8 · Published 2026-07-11

A popular WordPress plugin used for website design is vulnerable to a security flaw that allows low-level users to take over administrator accounts. By exploiting a weakness in how the plugin handles email notifications, an attacker can intercept password reset links intended for site administrators. This could lead to a total loss of control over the website and unauthorized access to sensitive data.

Technologies: [WPDeveloper Essential Addons for Elementor](https://junglewise.ai/threats/technologies/essential-addons-for-elementor). Vendors: [WPDeveloper](https://junglewise.ai/threats/vendors/wpdeveloper).

## Quick answers

**Is CVE-2026-15155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15155 being exploited in the wild.

**How severe is CVE-2026-15155?** High severity, with a CVSS score of 8.8, published 11 July 2026.

**Which products and versions are affected?** WPDeveloper Essential Addons for Elementor up to, and including, 6.6.10.

**Is there a fix for CVE-2026-15155?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15155 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15155?** Check whether you run WPDeveloper Essential Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Email Header Injection (CWE-640) within the Login/Register widget of the Essential Addons for Elementor plugin. The root cause is insufficient server-side validation and sanitization of widget settings used to construct outgoing email headers; specifically, the plugin fails to strip or encode Carriage Return/Line Feed (CRLF) characters. An authenticated attacker with Contributor-level permissions or higher can inject a 'Bcc' header into the administrator's password-reset notification. This allows the attacker to receive a copy of the valid reset link, leading to full account takeover. The issue is addressed in version 6.6.11.

## Affected products

- wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets up to, and including, 6.6.10

## Timeline

- 2026-07-11: advisory: NVD publication date
- 2026-07-11: disclosed: Wordfence disclosure date

## References

- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Elements/Login_Register.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Elements/Login_Register.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Elements/Login_Register.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Elements/Login_Register.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php)
- [https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php](https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php)
- [https://plugins.trac.wordpress.org/changeset/3601504/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php](https://plugins.trac.wordpress.org/changeset/3601504/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php)

## Related threats

- [WPDeveloper Essential Addons for Elementor privilege escalation](https://junglewise.ai/threats/cve-2026-110898-incorrect-privilege-assignment-vulnerability-in-wpdeveloper)
- [WPDeveloper Essential Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-102394-improper-neutralization-of-input-during-web-page-generation)
- [WPDeveloper Essential Addons for Elementor authentication bypass](https://junglewise.ai/threats/cve-2026-81777-wpdeveloper-essential-addons-for-elementor-authentication-bypass)
- [Essential Addons for Elementor information disclosure in product-comparison feature](https://junglewise.ai/threats/cve-2026-13345-essential-addons-for-elementor-information-disclosure-in-product)
- [WPDeveloper Essential Addons for Elementor Stored XSS in Fancy Text Widget](https://junglewise.ai/threats/cve-2026-15145-wpdeveloper-essential-addons-for-elementor-stored-xss-in-fancy)