CVE-2024-3927

MEDIUM

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-3927 has a selected CVSS score of 5.3 (medium).

Description

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 22, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Element Pack – Widgets, Templates & Addons for Elementor

Browse bdthemes / Element Pack – Widgets, Templates & Addons for Elementor

Default status: unaffected

CVE ListThrough 5.6.3affected

References

4