PT-2026-57416 · WordPress · Essential Addons For Elementor

Jonah Burgess · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-15155

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Essential Addons for Elementor versions prior to 6.6.11

Description Insufficient server-side validation of a Login/Register widget setting allows authenticated attackers with Contributor-level access or higher to perform Email Header Injection. The restriction on allowed values is only enforced in the client-side editor UI, and the sanitization process fails to strip or encode Carriage Return (CR) and Line Feed (LF) characters. This allows CRLF sequences to be injected into raw mail headers, enabling an attacker to add a Bcc header to the WordPress administrator's password-reset notification email. By receiving a copy of the valid password-reset link, the attacker can achieve full administrator account takeover.

Recommendations Update to version 6.6.11 or later.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-15155

Affected Products

Essential Addons For Elementor

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-15155 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cbe8cf6c-b1fa-4f71-bb63-c8b181e54882?source=cve · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php#L1271 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fessential-addons-for-elementor-lite/tags/6.6.10&new_path=%2Fessential-addons-for-elementor-lite/tags/6.6.11 · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php#L1271 · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Elements/Login_Register.php#L3333 · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php#L1622 · Note
• https://twitter.com/CVEnew/status/2075869768200929605 · Twitter Post
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php#L1622 · Note
• https://plugins.trac.wordpress.org/changeset/3601504/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php · Note
• https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Elements/Login_Register.php#L3333 · Note