Essential Addons for Elementor – Popular Elementor Templates & Widgets: Privilege escalation or authentication bypass

Essential Addons for Elementor – Popular Elementor Templates & Widgets is affected by privilege escalation or authentication bypass. Exploitation requires at least contributor-level access. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 6.6.10.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Essential Addons for Elementor – Popular Elementor Templates & Widgets
Plugin slug: essential-addons-for-elementor-lite
Affected: <= 6.6.10
Safe version: > 6.6.10
Published: Jul 11, 2026
Weakness: CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

This CVE was published Jul 11, 2026 and is one of 29 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Essential Addons for Elementor – Popular Elementor Templates & Widgets to a release after 6.6.10, or disable and remove it until a fixed version is available.

Source record

Technical description

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Patch or disable the affected component.

Technical description

Primary and upstream sources