CVE-2024-3927
Medium
Description
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form.
SeverityMedium
CVSS5.3
Exploit probability—
ProductBdthemes Element Pack
PublishedMay 22, 2024
First seenMay 22, 2024
Weakness typeCWE-424CWE-424
How to fix
Update
- bdthemes element_pack5.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bdthemes element_pack | v < 5.6.4 | 5.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.