Authenticated Account Takeover via Email Header Injection in Essential Addons for Elementor

Executive Summary

The vulnerability exists in the Essential Addons for Elementor plugin for WordPress, specifically in versions up to and including 6.6.10. It is an Authenticated Account Takeover vulnerability caused by Email Header Injection.

The issue arises because the plugin does not properly validate a Login/Register widget setting on the server side. While the client-side editor UI restricts allowed values, the server does not enforce these restrictions and fails to sanitize carriage return and line feed (CR/LF) characters.

This allows an authenticated attacker with Contributor-level access or higher to inject additional email headers, such as a Bcc header, into the administrator's password-reset notification email. By doing so, the attacker can receive a copy of the administrator's password-reset link and take over the administrator account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows an attacker with relatively low privileges (Contributor-level access) to escalate their privileges to full administrator control.

By injecting a Bcc header into password-reset emails, the attacker can intercept the administrator's password-reset link, reset the administrator password, and gain full control over the WordPress site.

This can lead to complete compromise of the website, including unauthorized access to sensitive data, modification or deletion of content, installation of malicious code, and disruption of site operations.

Useful 0 Not Useful 0