Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
The Plus Addons for Elementor plugin lets attackers hijack emails and redirects
CVE-2026-2385
Summary
The Plus Addons for Elementor plugin for WordPress has a security flaw that allows attackers to intercept and redirect emails, and potentially take control of website links. This affects all versions up to 6.4.7. Update to the latest version to fix the issue.
Original title
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all...
Original description
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.
nvd CVSS3.1
5.3
Vulnerability type
CWE-345
Published: 22 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026