Essential Addons for Elementor – Popular Elementor Templates & Widgets Plugin (<= 6.6.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/essential-addons-for-elementor--popular-elementor-templates--widgets-plugin--6.6.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 11 Jul 2026 07:19:11 +0000Authenticated Account Takeover in Essential Addons for Elementor WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-15155/Sat, 11 Jul 2026 07:19:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-15155/A vulnerability (CVE-2026-15155) in the Essential Addons for Elementor WordPress plugin, specifically within its Login/Register widget, allows authenticated attackers with Contributor-level access or higher to achieve administrator account takeover by injecting an additional Bcc header into administrator password-reset notification emails.A critical vulnerability, tracked as CVE-2026-15155, has been identified in the Essential Addons for Elementor - Popular Elementor Templates & Widgets plugin for WordPress, affecting all versions up to and including 6.6.10. This flaw enables authenticated attackers with Contributor-level privileges or higher to execute an administrator account takeover. The vulnerability stems from insufficient server-side validation of a Login/Register widget setting, which is used to construct outgoing email headers. While client-side UI enforces allowed values, the server-side processing lacks proper sanitization to strip or encode CR/LF characters. This allows attackers to embed CR/LF sequences into the setting, which then propagate into raw email headers. By injecting an additional Bcc header containing an attacker-controlled email address into the WordPress administrator's password-reset notification email, the attacker can intercept the password-reset link and gain full administrative control over the WordPress site. The CVSS v3.1 Base Score for this vulnerability is 8.8, indicating high severity.

Attack Chain

  1. An authenticated attacker with Contributor-level access or higher gains access to the WordPress dashboard.
  2. The attacker navigates to and modifies a specific setting within the Login/Register widget of the Essential Addons for Elementor plugin.
  3. The attacker injects Carriage Return (CR) and Line Feed (LF) characters (%0D%0A or similar encoding) into the vulnerable setting, followed by Bcc: attacker@example.com.
  4. The WordPress administrator initiates a password reset for their account.
  5. The WordPress system generates a password-reset notification email for the administrator.
  6. Due to the vulnerability, the injected Bcc header from the modified widget setting is included in the raw email headers.
  7. A copy of the password-reset notification email, including the unique reset link, is sent to the attacker's email address.
  8. The attacker uses the intercepted password-reset link to change the administrator's password and subsequently log in as the administrator, achieving full account takeover.

Impact

Successful exploitation of CVE-2026-15155 leads to complete administrator account takeover on the affected WordPress site. This can result in severe consequences, including but not limited to, website defacement, arbitrary code execution (e.g., injecting malware or web shells), data theft, compromise of user databases, SEO spam injection, or use of the compromised website for further attacks against other systems. Organizations using the vulnerable plugin risk significant reputational damage, data breaches, and potential legal or compliance repercussions.

Recommendation

  • Patch CVE-2026-15155 immediately by updating the "Essential Addons for Elementor - Popular Elementor Templates & Widgets" plugin to a version greater than 6.6.10.
  • Review WordPress audit logs (if enabled) for unusual plugin setting modifications by Contributor-level users or lower, especially those related to email configurations.
  • Examine email logs for WordPress-generated password reset notifications that contain unexpected Bcc headers or are sent to unknown external email addresses.
  • Implement strong authentication measures and regularly audit user privileges to ensure least privilege access across all WordPress user accounts.
]]>highadvisorywordpresspluginweb-applicationcveaccount-takeoveremail-injection