Vulnerability · Published Aug 6, 2026 · Assigned by Wordfence
CVE-2026-0673Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
Medium 5.3
In plain English
A medium-severity security flaw in Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons from bdthemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bdthemes | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | 0 – through 8.3.15 |
Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N