ElementInvader Addons for Elementor WordPress Plugin Exposes Email Functionality
CVE-2025-10873
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 5 November 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-10873?
The ElementInvader Addons for Elementor WordPress plugin has a vulnerability that allows any unauthenticated user to send emails to any email address. This security flaw arises from a lack of proper authorization in the 'elementinvader_addons_for_elementor_forms_send_form' action, enabling attackers to exploit the feature and potentially commit phishing attacks or spam unwanted messages.
Affected Version(s)
ElementInvader Addons for Elementor 0 < 1.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.