The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.
CVE-2026-15155
Score 8.8 from GitHub Security Advisory (severity: HIGH) published 2026-07-11. a secondary CVSS source baseline 8.8; sources differ by 0.0.
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 8.8
- EG Score
- 8.8(high)
- EPSS
- —
- KEV
- Not listed
Published
July 11, 2026
Last Modified
July 11, 2026
References (9)
- security@wordfencehttps://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Elements/Login_Register.php#L3333
- security@wordfencehttps://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php#L1271
- security@wordfencehttps://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.10/includes/Traits/Login_Registration.php#L1622
- security@wordfencehttps://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Elements/Login_Register.php#L3333
- security@wordfencehttps://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php#L1271
- security@wordfencehttps://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.6.5/includes/Traits/Login_Registration.php#L1622
- security@wordfencehttps://plugins.trac.wordpress.org/changeset/3601504/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php
- security@wordfencehttps://plugins.trac.wordpress.org/changeset?old_path=%2Fessential-addons-for-elementor-lite/tags/6.6.10&new_path=%2Fessential-addons-for-elementor-lite/tags/6.6.11
- security@wordfencehttps://www.wordfence.com/threat-intel/vulnerabilities/id/cbe8cf6c-b1fa-4f71-bb63-c8b181e54882?source=cve
Vendor Advisories for CVE-2026-15155(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 4× in last 7d / 4× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-07-11 17:34 UTCEG score recompute
- 2026-07-11 17:34 UTCGHSA enrichment
- 2026-07-11 06:24 UTCEG score recompute
- 2026-07-11 06:22 UTCMITRE cvelistV5first tracked
Frequently asked(4)
What is CVE-2026-15155?
When was CVE-2026-15155 disclosed?
What is the CVSS score of CVE-2026-15155?
How do I remediate CVE-2026-15155?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-15155
Is Your Infrastructure Affected by CVE-2026-15155?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.