CVE-2026-2385
Received Received - Intake

Insufficient Data Verification in The Plus Addons for Elementor Enables Email Relay

Publication date: 2026-02-22

Last updated on: 2026-02-22

Assigner: Wordfence

Description
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-22
Last Modified
2026-02-22
Generated
2026-07-06
AI Q&A
2026-02-22
EPSS Evaluated
2026-07-04
NVD
CVE-2026-2385
EUVD
EUVD-2026-7692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_plus_addons for_elementor to 6.4.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in The Plus Addons for Elementor WordPress plugin, versions up to and including 6.4.7. It is caused by insufficient verification of data authenticity, where the plugin decrypts and trusts attacker-controlled 'email_data' in an unauthenticated AJAX handler without proper cryptographic guarantees.

This flaw allows unauthenticated attackers to manipulate form email routing and redirection values by tampering with the 'email_data' parameter.

Impact Analysis

The vulnerability can lead to unauthorized email relay and attacker-controlled redirection. This means attackers can potentially send emails through the vulnerable system without permission and redirect users to malicious sites.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart