Description
The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ElementInvader Addons for Elementor | < 1.4.1 | 1.4.1 |
References
- https://wpscan.com/vulnerability/2eb133db-e1c5-409e-94f8-b71edca5db16/ exploit vdb-entry technical-description