CVE-2026-0673
Received Received - Intake

Email Header Injection in Element Pack Addons for Elementor

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Wordfence

Description
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-0673
EUVD
EUVD-2026-53870

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
element_pack element_pack_addons_for_elementor to 8.3.15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Element Pack Addons for Elementor plugin for WordPress has a vulnerability in versions up to 8.3.15. It allows unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form due to insufficient sanitization of newline characters in user input.

Detection Guidance

Check for unauthorized email headers in contact form submissions. Inspect WordPress plugin logs for unusual AJAX calls to element_pack_contact_form. Review email server logs for unexpected email traffic from the WordPress site.

Impact Analysis

Attackers could exploit this to send spam emails or phishing messages through your website, potentially damaging your reputation or causing your domain to be blacklisted.

Mitigation Strategies
  • Update the Element Pack Addons for Elementor plugin to the latest version if available.
  • Disable the plugin temporarily if an update is not immediately available.
  • Implement input validation for user-supplied data in contact forms.
  • Monitor outgoing emails for suspicious activity or unauthorized headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart