CVE-2026-15155 is a vulnerability in the Essential Addons for Elementor – Popular Elementor Templates & Widgets WordPress plugin. The issue arises because the server-side does not properly validate or sanitize a Login/Register widget setting used in outgoing email headers. Client-side UI restrictions on allowed values are bypassed, and CRLF characters are not stripped or encoded, enabling CRLF injection into raw mail headers. Authenticated attackers with Contributor-level permissions or higher can inject a Bcc header into administrator password-reset emails, intercept the reset link, and achieve full administrator account takeover. The vulnerability affects all versions up to and including 6.6.10. There is no vendor advisory or patch available at this time.

An attacker with Contributor-level or higher access can exploit this vulnerability to intercept administrator password-reset emails by injecting a Bcc header. This allows the attacker to obtain valid password-reset links for administrator accounts, leading to full administrator account takeover. The impact includes complete compromise of the WordPress site’s administrative functions, confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only. Monitor for suspicious email activity related to password resets. Avoid using affected plugin versions if possible.