CVE-2026-0673: Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Element Pack Addons for Elementorto a version that resolves this vulnerability.Fixed in 8.3.15 - Compensating control
Restrict access to the `element_pack_contact_form` AJAX endpoint so only authenticated/authorized users can invoke the contact form submission functionality.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0673?
The severity of CVE-2026-0673 is classified as medium with a score of 5.3.
How do I fix CVE-2026-0673?
To fix CVE-2026-0673, upgrade the Element Pack Addons for Elementor plugin to version 8.3.16 or later.
What type of vulnerability is CVE-2026-0673?
CVE-2026-0673 is an Email Header Injection vulnerability caused by insufficient sanitization of user input.
What impact does CVE-2026-0673 have?
CVE-2026-0673 allows for the potential injection of malicious SMTP headers without user authentication.
In which software is CVE-2026-0673 found?
CVE-2026-0673 is found in the Element Pack Addons for Elementor plugin for WordPress.