What the vulnerability does
01Description
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.
Explanation of Vulnerability in Simple Terms
02Summary
The Plus Addons for Elementor contains an integrity vulnerability affecting versions up to 6.4.7. An attacker on the network can modify data or content without authentication or user interaction. The vulnerability has low integrity impact and does not affect confidentiality or availability. Site administrators should update to a version newer than 6.4.7 when available.
What an attacker can do
03Attacker Capabilities
Modify site data or content without needing to log in or interact with a user.
Potential impact on your site
04Site Impact
Attackers can alter your site's content, settings, or data without your knowledge or permission.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user action required.
Key dates
06Disclosure timeline
February 22, 2026
CVE published
April 8, 2026
Record updated
