CVE-2024-3927 Security feature bypass in Element Pack – Widgets, Templates & Addons for Elementor

What is CVE-2024-3927?

CVE-2024-3927 is a medium-severity vulnerability in bdthemes Element Pack – Widgets, Templates & Addons for Elementor, published on 22 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form.

Weakness: CWE-424

Which versions are affected by CVE-2024-3927?

It affects 1 product.

Products include Bdthemes Element Pack.

How do I fix CVE-2024-3927?

No fix has been published for CVE-2024-3927 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-3927 being exploited?

There is no known exploitation of CVE-2024-3927 in the wild and no public exploit code.

Other vulnerabilities in bdthemes Element Pack – Widgets, Templates & Addons for Elementor

• CVE-2024-33568 WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability High 8.5
• CVE-2024-30496 WordPress Element Pack Lite plugin <= 5.5.3 - SQL Injection vulnerability High 8.5
• CVE-2024-9657 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor Medium 6.5
• CVE-2024-47392 WordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-4359 Path traversal in Element Pack – Widgets, Templates & Addons for Elementor Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4fph-66x7-mxrv.