CVE-2026-2385: Elementor Plus Addons Auth Bypass Flaw

CVE-2026-2385 Overview

CVE-2026-2385 is an Insufficient Verification of Data Authenticity vulnerability affecting The Plus Addons for Elementor plugin for WordPress. This popular plugin, which provides addons, page templates, widgets, mega menu functionality, and WooCommerce integration for Elementor, contains a critical flaw in how it processes form data. The vulnerability exists in all versions up to and including 6.4.7, where the plugin decrypts and trusts attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees.

Critical Impact

Unauthenticated attackers can tamper with form email routing and redirection values, enabling unauthorized email relay and attacker-controlled redirection through the vulnerable email_data parameter.

Affected Products

• The Plus Addons for Elementor plugin for WordPress versions up to and including 6.4.7
• WordPress installations running vulnerable plugin versions
• Sites utilizing the plugin's form handling and email routing functionality

Discovery Timeline

• 2026-02-22 - CVE CVE-2026-2385 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2385

Vulnerability Analysis

This vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity), a security weakness that occurs when an application fails to properly verify that data has been provided by a legitimate source or has not been modified in transit. In the context of The Plus Addons for Elementor plugin, the vulnerability manifests in an unauthenticated AJAX handler that processes form submissions.

The core issue lies in how the plugin handles the email_data parameter during form processing. While the data undergoes decryption, the plugin fails to implement cryptographic authenticity verification, such as message authentication codes (MACs) or digital signatures. This architectural flaw allows attackers to craft malicious payloads that the system will accept and process as legitimate form data.

Root Cause

The root cause of this vulnerability stems from a fundamental cryptographic design flaw in the plugin's form handling mechanism. The developers implemented encryption for the email_data parameter but neglected to add authenticity verification. Encryption alone provides confidentiality but does not guarantee that the data originated from a trusted source or has not been tampered with.

Without integrity checking mechanisms like HMAC (Hash-based Message Authentication Code) or authenticated encryption modes (such as AES-GCM), attackers can manipulate the encrypted payload. The system decrypts and processes this manipulated data without questioning its origin or integrity, creating a path for exploitation.

Attack Vector

The attack vector is network-based and requires no authentication, making it accessible to any remote attacker. The exploitation flow involves:

1. An attacker identifies a WordPress site running a vulnerable version of The Plus Addons for Elementor plugin
2. The attacker crafts a malicious request targeting the unauthenticated AJAX handler
3. The malicious request contains a manipulated email_data parameter with modified email routing destinations and redirection URLs
4. The plugin decrypts and processes the attacker-controlled data without verifying its authenticity
5. The system executes the attacker's instructions, potentially sending emails to unauthorized recipients or redirecting users to malicious destinations

The vulnerability enables two primary attack scenarios: unauthorized email relay (where attackers can use the affected site as an email relay for spam or phishing campaigns) and open redirection (where users submitting forms are redirected to attacker-controlled websites). For detailed technical information, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-2385

Indicators of Compromise

• Unusual outbound email traffic originating from the WordPress server to unexpected recipients
• Form submission logs showing suspicious redirection URLs that point to external domains
• AJAX requests to the plugin's form handler containing malformed or unexpected email_data parameter values
• User complaints about being redirected to unfamiliar websites after form submission

Detection Strategies

• Monitor WordPress AJAX endpoints for unusual request patterns, particularly those targeting The Plus Addons for Elementor form handlers
• Implement web application firewall (WAF) rules to inspect and validate the email_data parameter in incoming requests
• Review server email logs for unauthorized relay attempts or emails sent to domains not associated with legitimate form recipients
• Configure intrusion detection systems to alert on suspicious POST requests to WordPress admin-ajax.php with plugin-specific actions

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and form submissions
• Set up alerts for outbound email volume anomalies that may indicate abuse of the email relay functionality
• Monitor for HTTP 302/301 redirects to external domains that were not configured in the plugin settings
• Review the WordPress plugin changelog for security updates and patching status

How to Mitigate CVE-2026-2385

Immediate Actions Required

• Update The Plus Addons for Elementor plugin to a version newer than 6.4.7 immediately
• If immediate patching is not possible, consider temporarily disabling the plugin's form functionality
• Review email logs and server access logs for signs of previous exploitation
• Audit any forms created with the plugin to verify email routing configurations have not been tampered with

Patch Information

The vulnerability has been addressed in plugin versions released after 6.4.7. Site administrators should update to the latest available version through the WordPress plugin update mechanism. The patch adds proper cryptographic authenticity verification to the email_data parameter processing, preventing attackers from manipulating form routing and redirection values.

Detailed information about the security fix can be found in the WordPress Plugin Change Log.

Workarounds

• Implement a Web Application Firewall (WAF) with rules to validate and sanitize the email_data parameter in requests to the affected AJAX handlers
• Temporarily disable The Plus Addons for Elementor form widgets and use alternative form solutions until patching is complete
• Configure server-level email restrictions to limit outbound email recipients to approved domains only
• Add .htaccess or server configuration rules to block direct access to the vulnerable AJAX endpoints from untrusted sources

# Example: Block external access to admin-ajax.php for specific actions
# Add to .htaccess (Apache) - adjust for your specific environment
<FilesMatch "admin-ajax.php">
    <If "%{QUERY_STRING} =~ /action=theplus_form_ajax/ && -n '%{HTTP_REFERER}' && '%{HTTP_REFERER}' !~ /yourdomain\.com/">
        Require all denied
    </If>
</FilesMatch>