CVE-2026-2385

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2385", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-11T22:53:35.124Z", "datePublished": "2026-02-22T08:24:44.635Z", "dateUpdated": "2026-04-08T17:09:16.352Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:16.352Z"}, "affected": [{"vendor": "posimyththemes", "product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter."}], "title": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9176535c-8e37-4a18-b458-a71c4a84daa4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-345 Insufficient Verification of Data Authenticity", "cweId": "CWE-345", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "timeline": [{"time": "2026-02-11T23:50:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-21T19:49:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T18:30:38.445551Z", "id": "CVE-2026-2385", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T18:30:50.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2385", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T18:30:38.445551Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T18:30:44.056Z"}}], "cna": {"title": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay", "credits": [{"lang": "en", "type": "finder", "value": "Qu\u1ed1c Huy"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "posimyththemes", "product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.4.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-11T23:50:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-21T19:49:02.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9176535c-8e37-4a18-b458-a71c4a84daa4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder"}], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:16.352Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2385", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:09:16.352Z", "dateReserved": "2026-02-11T22:53:35.124Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-22T08:24:44.635Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "vendor": "posimyththemes", "versions": [{"lessThanOrEqual": "6.4.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter."}, {"lang": "es", "value": "El plugin The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce para WordPress es vulnerable a la verificaci\u00f3n insuficiente de la autenticidad de los datos en todas las versiones hasta la 6.4.7, inclusive. Esto se debe a que el plugin descifra y conf\u00eda en datos de correo electr\u00f3nico (email_data) controlados por el atacante en un gestor AJAX no autenticado sin garant\u00edas criptogr\u00e1ficas de autenticidad. Esto permite a los atacantes no autenticados manipular los valores de enrutamiento y redirecci\u00f3n de correo electr\u00f3nico del formulario para desencadenar un reenv\u00edo de correo electr\u00f3nico no autorizado y una redirecci\u00f3n controlada por el atacante a trav\u00e9s del par\u00e1metro 'email_data'."}], "id": "CVE-2026-2385", "lastModified": "2026-06-17T10:30:52.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2385", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T18:30:38.445551Z", "version": "2.0.3"}}]}, "published": "2026-02-22T09:16:10.107", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3463156/the-plus-addons-for-elementor-page-builder"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9176535c-8e37-4a18-b458-a71c4a84daa4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce", "source": "cna", "vendor": "posimyththemes"}, "product": "the_plus_addons_for_elementor_\u2013_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce", "vendor": "posimyththemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:16:22.946127+00:00", "value": {"mitigation_remediation": ["Upgrade The Plus Addons for Elementor plugin to the latest version (\u2265\u202f6.4.8) to remove the vulnerable AJAX handler.", "If an update cannot be applied immediately, block unauthenticated access to the plugin\u2019s AJAX endpoint through a web\u2011application firewall or by restricting the endpoint to authenticated administrators.", "Monitor outbound email logs for abnormal traffic originating from the site and block any external requests that include the email_data parameter to prevent misuse."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Email Relay"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin \"The Plus Addons for Elementor \u2013 Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce\" developed by PosimythThemes. All releases up to and including version 6.4.7 are impacted. Users running these older plugin versions on any WordPress site are susceptible.", "description_and_impact": "This vulnerability arises from the plugin decrypting and trusting attacker\u2011controlled email_data in an unauthenticated AJAX handler without any cryptographic authenticity guarantees. The flaw allows an attacker to modify form email routing and redirection values through the email_data parameter, enabling the plugin to send email traffic on the site\u2019s behalf and perform redirection to attacker\u2011controlled URLs. The impact is the potential for spam, phishing, or other malicious email distribution, compromising the site\u2019s reputation and possibly facilitating further social engineering attacks. The weakness is classified as CWE\u2011345, Insufficient Verification of Data Authenticity. The plugin thus exposes the email infrastructure to unauthorized use.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation at the time of this assessment. The vulnerability is not currently listed in the CISA KEV catalog, but should still be treated seriously because the attack vector is anonymous and requires no credentials. An unauthenticated attacker can trigger the vulnerable AJAX endpoint by sending crafted requests containing the email_data payload, leading to uncontrolled email relay and potential redirect abuse."}}}}, "created": "2026-02-23T14:29:21.183738+00:00", "updated": "2026-04-15T20:30:13.765574+00:00", "vendors": ["posimyththemes", "posimyththemes$PRODUCT$the_plus_addons_for_elementor_\u2013_addons_for_elementor,_page_templates,_widgets,_mega_menu,_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}