Description

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T13:17:21.387Z",
  "pubdate": "2026-08-06T13:17:21.387Z",
  "executiveSummary": "The Element Pack Addons for Elementor plugin for WordPress is vulnerable to an Email Header Injection vulnerability across all versions up to, and including, 8.3.15.\nThis security flaw stems from insufficient sanitization of newline characters within user-supplied input handled by the element_pack_contact_form AJAX action.\nUnauthenticated remote threat actors can exploit this vulnerability by injecting arbitrary email headers into outgoing communications generated by the contact form.\nThe primary risk implications include potential email spoofing, phishing campaign distribution, spam relaying, and compromise of communication integrity originating from the vulnerable WordPress instance.\nSuccessful exploitation requires no prior authentication or elevated privileges, making it accessible to any external attacker capable of interacting with the target web application over the network.",
  "technicalDetails": "The vulnerability resides in the contact form processing mechanism of the Element Pack Addons for Elementor plugin, specifically within the handling of the element_pack_contact_form AJAX action.\nThe root cause of the flaw is the lack of proper input validation and sanitization regarding newline characters, such as carriage returns (%0d) and line feeds (%0a), present in user-supplied input fields.\nDuring execution, the application concatenates these unsanitized parameters directly into the headers of outbound emails constructed and dispatched by the server.\nAn unauthenticated attacker initiates the attack flow by crafting malicious HTTP POST requests directed at the element_pack_contact_form AJAX endpoint.\nThe attacker supplies input data containing injected newline characters followed by arbitrary email headers, such as Cc, Bcc, or Subject, within the form fields.\nBecause the vulnerable component fails to strip or encode these control characters, the underlying mail transfer mechanism interprets them as genuine header delimiters.\nThis allows the attacker to manipulate the structure of the resulting email message, appending unauthorized recipients or altering message metadata.\nThe attack is exposed over the network, requires no authentication or user interaction prerequisites, and impacts all plugin versions up to, and including, 8.3.15."
}