CVE Feed

    Dashboard / CVE / CVE-2026-0673

    CVE-2026-0673

    The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

    Published:Aug 6, 2026
    Last Modified:Aug 11, 2026
    EPS:Aug 6, 2026
    EPSS Score:0.0021
    CVSS Score:5.3

    Affected Products

    Vendor
    Bdthemes
    Product
    Element Pack Addons For Elementor
    Vendor
    Wordpress
    Product
    Wordpress

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-15 Command Delimiters
    CAPEC-81 Web Server Logs Tampering

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High