The Plus Addons for Elementor Unauthenticated Email Relay Vulnerability

A vulnerability exists in The Plus Addons for Elementor WordPress plugin, specifically in versions through 6.4.7. The issue arises from the plugin's AJAX handler, which decrypts and trusts email routing data controlled by attackers, without proper authentication. This flaw allows unauthenticated attackers to manipulate email redirection and routing, potentially leading to unauthorized email being sent or redirected.

Impact

Exploitation of this vulnerability could result in unauthorized email relay and redirection, allowing attackers to control where emails are sent or how they are received.

Remediation

Users are advised to update the plugin to version 6.4.8 or a newer patched version.