Medium severity5.3NVD Advisory· Published Aug 6, 2026· Updated Aug 6, 2026

CVE-2026-0673

Description

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the element_pack_contact_form AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Element Pack Elementor Addonsllm-fuzzy
Range: <=8.3.15

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.3.16/modules/contact-form/module.phpnvd
www.wordfence.com/threat-intel/vulnerabilities/id/941d0647-5027-4642-88fc-3ab26acbb639nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000