Email Header Injection Vulnerability in Elementor Addons by WPDeveloper

CVE-2026-15155

What is CVE-2026-15155?

The Essential Addons for Elementor plugin is exposed to a significant security issue where insufficient server-side validation of the Login/Register widget's email header settings can lead to account takeover. Attackers, holding Contributor-level access or higher, can exploit this vulnerability by injecting malicious Bcc headers into outgoing password reset emails, consequently intercepting sensitive password reset links. This flaw exists in all versions up to and including 6.6.10, necessitating prompt user attention to fortify their WordPress installations.

References