Description (CNA)
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| bdthemes / Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | affected 0 through 8.3.15 |
CWE
CWE-93
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/941d0647-5027-4642-88fc-3ab26acbb639?source=cve
- https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.3.16/modules/contact-form/module.php?marks=209#L209
ADP enrichment
No English description supplied.
No references supplied.