CVE-2026-0673

Executive Summary

CVE-2026-0673 is an unauthenticated SMTP Header Injection vulnerability affecting the Element Pack Addons for Elementor WordPress plugin, specifically all versions up to and including 8.3.15. The flaw exists in the element_pack_contact_form AJAX action, where insufficient newline character sanitization allows unauthenticated attackers to inject arbitrary email headers into emails dispatched through the contact form. Given the plugin's widespread deployment across WordPress sites, this vulnerability enables email spoofing, phishing campaign facilitation, and potential bypass of email security controls, warranting urgent attention from organizations operating affected installations.

Technical Analysis

Root Cause and Vulnerability Mechanism

The vulnerability stems from improper handling of user-supplied input within the contact form's AJAX handler. When a site visitor submits a contact form, the plugin constructs email headers (such as From, To, Reply-To, Cc, Bcc) by concatenating unsanitized user input. The critical flaw is the lack of sanitization of CRLF (\r\n) characters, which are the standard delimiters for email header injection attacks.

In proper email protocol implementation per RFC 5322, header fields are separated by CRLF sequences. When user-controlled input containing %0d%0a (URL-encoded CRLF) is placed into a header value without stripping or encoding these characters, an attacker can terminate the current header and introduce new arbitrary headers. The vulnerable code path likely resembles:

wp_mail(
    $admin_email,
    $subject,
    $message_body,
    "From: " . $_POST['contact_email']  // ← unvalidated newline injection point
);

Attack Surface

The vulnerability is exploitable via a standard HTTP POST request containing form fields with embedded CRLF sequences. Because WordPress's wp_ajax_nopriv_* hooks handle AJAX requests without requiring user authentication, any anonymous visitor can trigger this vulnerability — hence the CVSS vector containing PR:N (no privileges required).

Severity Analysis

The CVSS score of 5.3 (Medium) reflects:

• Confidentiality Impact: None — no direct data disclosure
• Integrity Impact: Low — email content/headers can be modified; can facilitate social engineering
• Availability Impact: None — no service disruption capability

CWE Classification

The vulnerability aligns with CWE-93 (Improper Neutralization of CRLF Sequences), which explicitly covers failure to sanitize CRLF characters in email-related contexts.

Exploitation Scenarios

Attack Chain — Email Spoofing via CRLF Injection

Step 1: Target Identification and Reconnaissance

The attacker identifies WordPress sites running the Element Pack Addons plugin through:

• Running a WordPress scanner (e.g., WPScan) to enumerate plugin versions
• Leveraging Shodan dorks: http.title:"WordPress" http.component:"element-pack", http.body:"element_pack_contact_form", http.component:"Elementor" http.component:"Element Pack"
• Checking the plugin's readme.txt (/wp-content/plugins/bdthemes-element-pack-lite/readme.txt) for version disclosure

Step 2: Crafting the Malicious Request

The attacker crafts an HTTP POST request targeting the WordPress admin-ajax endpoint:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim-site.com
Content-Type: application/x-www-form-urlencoded
Content-Length: [calculated]

action=element_pack_contact_form&contact_name=TestUser&contact_email=attacker%40evil.com%0d%0aBcc:%20victim1%40target.com,%20victim2%40target.com%0d%0aX-Custom-Header:%20spam&contact_subject=Urgent%20Invoice%20Pending&message=Click%20here%20to%20review%20your%20overdue%20invoice%3A%20https%3A%2F%2Fevil-phishing.com%2Ffake-login

Step 3: Email Header Injection and Payload Execution

When processed, the injected input causes the email to be sent with:

• Primary recipient: The admin's configured contact form address
• BCC recipients: victim1@target.com, victim2@target.com (injected)
• Additional headers: Custom X-Custom-Header proving injection
• The email body contains the phishing payload URL

Step 4: Post-Exploitation Activities

┌─────────────────────────────────────────────────────────────────────┐
│ POST-EXPLOITATION IMPACT MATRIX                                     │
├─────────────────────────────────────────────────────────────────────┤
│ 1. PHISHING → Spoofed emails bypass SPF/DKIM because they are       │
│    sent by the legitimate WordPress server (forged From header).    │
│ 2. SPAM → Injected Bcc headers enable mass mailing to arbitrary     │
│    recipient lists, turning vulnerable servers into anonymous       │
│    spambots.                                                        │
│ 3. MALICIOUS ATTACHMENTS → Header injection can prepend MIME       │
│    boundaries to deliver malware payloads to inboxes.               │
│ 4. BRAND ABUSE → Attacker impersonates the site owner in emails,   │
│    damaging brand trust and enabling social engineering.           │
│ 5. REPUTATION DAMAGE → Site's IP/domain gets blacklisted by         │
│    email providers (Spamhaus, Barracuda) due to spam sending.      │
│ 6. PERSISTENT INFRASTRUCTURE → Unpatched server becomes a long-term │
│    spam relay for future campaigns.                                 │
└─────────────────────────────────────────────────────────────────────┘

Realistic Attack Chain Summary: Unauthenticated attacker sends AJAX request → CRLF injection into email headers → server sends spoofed/phishing emails from legitimate domain → email reputation damage and phishing relay capability.

Impact Assessment

Business Impact

The Medium severity rating (5.3) understates the practical business damage. Key impacts include:

1. Email Supply Chain Compromise: Since emails originate from the WordPress server's IP, they carry legitimate SPF/DKIM signatures if properly configured. This weaponizes the trust placed in the domain, increasing phishing success rates.

2. Reputation Damage: Enterprise email blacklisting directly affects legitimate outbound communication. Compromised servers commonly appear on blocklists within 24 hours of spam sending detection.

3. Legal and Compliance Exposure: Sending unsolicited emails may violate CAN-SPAM, GDPR, or industry regulations, exposing organizations to regulatory penalties (GDPR fines up to €20M or 4% of global turnover).

4. Resource Exhaustion: Mass mailing from injected Bcc headers consumes server bandwidth and SMTP quotas, potentially affecting legitimate mail delivery.

Affected Systems

• WordPress installations running Element Pack Addons versions ≤ 8.3.15 (both Lite and Pro variants)
• Elementor page builder environments (required dependency)
• Environments where contact forms route through WordPress's wp_mail() function

Blast Radius Assessment

Detection Guidance

Sigma Rule

title: CVE-2026-0673 - WordPress Element Pack Contact Form CRLF Injection
id: 5a9f3c2b-187e-4f6a-9c8d-1e3b5a7d9f02
status: experimental
description: Detects attempts to exploit SMTP header injection via element_pack_contact_form AJAX action
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0673
tags:
    - attack.t1190
    - attack.initial_access
    - cve.2026.0673
    - cwe.93
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for WordPress sites'
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 'admin-ajax.php'
    filter_action:
        cs-uri-query|contains:
            - 'action=element_pack_contact_form'
    condition: selection and filter_action
    fields:
        - c-ip
        - cs-uri-query
        - sc-status
falsepositives:
    - Legitimate contact form submissions
    - Automated form fills from valid users
level: medium

YARA Rule

rule CVE_2026_0673_Element_Pack_CRLF_Injection
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-02-15"
        description = "Detect CRLF injection attempts against Element Pack contact form"
        cve = "CVE-2026-0673"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-0673"

    strings:
        $ajax_handler = "element_pack_contact_form"
        $admin_ajax   = "/wp-admin/admin-ajax.php"
        $crlf_encoded = "%0d%0a" ascii nocase
        $crlf_raw     = "\r\n" ascii
        $header_verbs = /(Bcc|Cc|Reply-To|From|To|X-[A-Za-z-]+):/ ascii nocase
        
    condition:
        $admin_ajax and $ajax_handler and 
        (any of ($crlf_encoded) or any of ($crlf_raw)) and
        any of ($header_verbs)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-0673 - Element Pack Contact Form SMTP Header Injection Attempt";
    flow:to_server,established;
    http.method == "POST";
    http.uri == "/wp-admin/admin-ajax.php";
    http.request_line contains "action=element_pack_contact_form";
    http.request_body contains "%0d%0a";
    content:"Bcc:"; http.request_body; nocase;
    content:"Cc:"; http.request_body; nocase;
    content:"Reply-To:"; http.request_body; nocase;
    pcre:"/[\r\n](Bcc|Cc|Reply-To|From|To|X-)[A-Za-z-]*:/i";
    sid:1002673;
    rev:1;
    metadata:cve CVE-2026-0673, cwe CWE-93, mitre_tactic T1190, severity medium;
)

Elastic Detection

Parameter: Event EQL in a detection rule with index template logs-*.

detection: |
  sequence by source.ip with maxspan=5s
    [ network where event.category == "web" and http.request.method == "POST" and
      url.path == "/wp-admin/admin-ajax.php" ]
    [ network where event.category == "web" and
      url.query == "*action=element_pack_contact_form*" and
      http.request.body.text contains "%0d%0a" and
      (http.request.body.text contains "Bcc:" or 
       http.request.body.text contains "Cc:" or 
       http.request.body.text contains "Reply-To:") ]

Splunk SPL Query

index="web" sourcetype="access_combined_wcookie"
| where method="POST" AND uri_path="/wp-admin/admin-ajax.php"
| regex uri_query="action=element_pack_contact_form"
| regex _raw="(%0d%0a|\\r\\n)"
| regex _raw="(Bcc:|Cc:|Reply-To:|From:|To:|X-[A-Za-z-]+:)"
| eval threat_score = 75
| stats count by src_ip, uri, _time, uri_query
| sort - count
| rename src_ip as "Attacker IP", uri as "Request URI", count as "Request Count"
| table _time "Attacker IP" "Request URI" "Request Count" uri_query
| where "Request Count" > 1

Wazuh OSSEC Rule

<group name="wordpress_access,">
  <rule id="100673" level="10">
    <decoded_as>web</decoded_as>
    <description>CVE-2026-0673 - Element Pack Contact Form SMTP Header Injection</description>
    <field name="url">\.*admin-ajax\.php</field>
    <field name="data">element_pack_contact_form</field>
    <regex>%0d%0a</regex>
    <regex>(Bcc:|Cc:|Reply-To:|From:|To:)</regex>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,wordpress,cve_2026_0673</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (Confidence 0/4) — as of the publication date, no patched version has been released. The vendor, BdThemes, has not yet provided a fix. The affected range is all versions ≤ 8.3.15.

1. Immediate Mitigations (Deploy Today)

Example Nginx Virtual Patch:

# Block CRLF injection in Element Pack contact form
location ~ ^/wp-admin/admin-ajax.php {
    if ($request_body ~* "(action=element_pack_contact_form).*(%0d%0a|\\r\\n).*(Bcc|Cc|Reply-To):") {
        return 403;
    }
    ...
}

2. Patch/Upgrade Steps (When Available)

1. Monitor the BdThemes Element Pack changelog for version release exceeding 8.3.15
2. Before updating: snapshot the site database and plugin directory
3. Update the plugin via WordPress Admin → Plugins → Update Now (or download from the official repository)
4. Verify version number via wp plugin list --name=bdthemes-element-pack-lite
5. Test contact form submission after update, confirming email delivery

3. Long-Term Hardening

• Enable Email Security: Ensure SPF, DKIM, and DMARC are correctly configured for the sending domain to mitigate spoofing even if injection occurs
• SMTP Relay Monitoring: Route wp_mail() through an authenticated SMTP relay (e.g., Amazon SES, SendGrid) with per-site sending limits
• Web Application Firewall: Maintain WAF rules updated with emerging CVEs; enable managed rules for WordPress CRLF injection patterns
• Plugin Minimization: Reduce exposure by disabling unused plugins/features. Only enable contact form on pages requiring it
• Regular Patch Management: Subscribe to vulnerability feeds (Patchstack, WPScan) targeting WordPress ecosystem
• Server-Level Email Controls: Implement outbound email rate limiting (e.g., postfix smtpd_client_message_rate_limit, exim rate limit) to cap anomaly spikes

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-0673
2. CVE Record (CNA): https://www.cve.org/CVERecord?id=CVE-2026-0673
3. WordPress Plugin Directory: https://wordpress.org/plugins/bdthemes-element-pack-lite/ (monitor for patched release)
4. Patchstack Vulnerability Database: https://patchstack.com/database/vulnerability/ (watch for detailed CVE-2026-0673 entry)
5. FIRST CVSS Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Threat Intelligence Notes: As of this report's publication, there are no confirmed reports of active exploitation in the wild or any known threat actor campaign leveraging CVE-2026-0673. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. While no public exploit code exists, the vulnerability class (CRLF injection) has extensive public documentation and weaponization techniques are readily adaptable — exploitation should be considered a realistic and imminent threat once mass-scanning weaponization occurs. Organizations running affected versions should treat this as a priority remediation item despite the Medium severity rating.