The Element Pack Elementor Addons plugin for WordPress contains an improper protection of alternate path vulnerability (CWE-424) identified as CVE-2024-3927. The plugin fails to correctly check all variations of administrator email addresses, specifically allowing bypass via the use of a '+' character in the email local part during form submissions. This flaw permits unauthenticated attackers to circumvent restrictions intended to limit form submissions to administrators, potentially enabling unauthorized form submission actions. The vulnerability is present in all versions up to and including 5.6.3. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and an impact limited to integrity.

The vulnerability allows unauthenticated attackers to bypass administrator email restrictions on form submissions by exploiting improper validation of alternate email paths. This could lead to unauthorized form submissions that may affect the integrity of the form processing or workflow. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting form submission capabilities or implementing additional validation controls on email addresses to prevent bypass via '+' variations. Monitor official bdthemes communications for updates and apply patches promptly once available.