CVE-2026-15155 Overview
CVE-2026-15155 affects the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress in all versions up to and including 6.6.10. The vulnerability enables authenticated account takeover through email header injection [CWE-640] in the Login/Register widget. Attackers with Contributor-level access or higher can inject a Bcc header into the WordPress administrator's password-reset notification email. This delivers a valid administrator password-reset link to an attacker-controlled inbox, resulting in full administrator account takeover.
Critical Impact
Authenticated attackers with Contributor privileges can hijack administrator accounts on WordPress sites running the vulnerable plugin, leading to complete site compromise.
Affected Products
- Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress
- All versions up to and including 6.6.10
- Fixed in version 6.6.11
Discovery Timeline
- 2026-07-11 - CVE-2026-15155 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-15155
Vulnerability Analysis
The vulnerability resides in the Login/Register widget of the Essential Addons for Elementor plugin. The widget exposes a setting that is embedded directly into outgoing email headers when the plugin generates password-reset notifications. Server-side code accepts this setting without validating it against the allowed values enforced by the client-side editor UI.
The sanitization applied to the value does not strip or encode carriage return (\r) or line feed (\n) characters. Carriage Return Line Feed (CRLF) sequences stored in the setting survive through to the raw mail headers passed to the mail transport layer. This is a classic email header injection flaw exposed through inadequate server-side input filtering.
Root Cause
The root cause is insufficient server-side validation combined with sanitization that fails to neutralize CRLF characters. The relevant handlers live in includes/Elements/Login_Register.php and includes/Traits/Login_Registration.php within the plugin source tree. Because the allowlist of valid values is only enforced in the Elementor editor JavaScript, an authenticated user who can save widget settings can supply arbitrary content, including newline-delimited additional headers.
Attack Vector
An attacker authenticated as a Contributor or higher edits or creates a page containing the Login/Register widget. The attacker sets the vulnerable widget field to a value containing a CRLF sequence followed by Bcc: attacker@example.com. When the WordPress administrator triggers a password-reset email, or when the flow is otherwise invoked, the outgoing mail headers include the injected Bcc. The attacker receives a copy of the reset email containing a valid one-time reset token and uses it to set a new administrator password. Refer to the Wordfence Vulnerability Analysis for additional technical detail.
No verified proof-of-concept code is publicly available at this time.
Detection Methods for CVE-2026-15155
Indicators of Compromise
- Unexpected password-reset emails sent to WordPress administrator accounts, particularly those originating from Contributor-driven page saves.
- Outbound SMTP traffic from the WordPress host containing Bcc headers pointing to external domains not owned by the organization.
- Newly created administrator accounts or unexpected password changes on administrator accounts shortly after a Contributor-level user edited a Login/Register widget.
- Elementor page revisions from Contributor accounts modifying Login/Register widget settings.
Detection Strategies
- Inspect the postmeta table for Elementor _elementor_data entries referencing the Login/Register widget and search stored settings for \r or \n byte sequences.
- Monitor WordPress mail logs and mail transport agent logs for outgoing password-reset emails containing Bcc, Cc, or duplicated To headers.
- Review audit logs for password-reset events immediately preceded by widget edits by non-administrator accounts.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture Elementor widget changes and user role changes.
- Forward WordPress wp_mail events and web application logs into a centralized log platform for correlation.
- Alert on administrator role assignments and password changes that occur outside approved change windows.
How to Mitigate CVE-2026-15155
Immediate Actions Required
- Update the Essential Addons for Elementor plugin to version 6.6.11 or later on all WordPress sites.
- Audit all users with Contributor role or higher and remove accounts that are unused or unrecognized.
- Rotate credentials for administrator accounts and force password resets from a trusted network path if compromise is suspected.
- Review recent Elementor page edits and email logs for signs of exploitation.
Patch Information
The vendor addressed the flaw in version 6.6.11 of the plugin. The fix is available in the WordPress Plugin Changeset 3601504 and the version diff between 6.6.10 and 6.6.11. Administrators should apply the update through the WordPress plugin management interface or by deploying the updated package.
Workarounds
- Restrict Contributor and higher roles to trusted users only until patching completes.
- Remove or disable the Login/Register widget on pages editable by non-administrator users.
- Configure the mail transport agent to reject outbound messages containing multiple recipient headers added by the application layer.
- Deploy a web application firewall rule that blocks POST requests to Elementor save endpoints containing CRLF byte sequences in widget settings.
# Verify installed plugin version via WP-CLI and update
wp plugin get essential-addons-for-elementor-lite --field=version
wp plugin update essential-addons-for-elementor-lite --version=6.6.11
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
