CVE-2024-3927

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form.

• CWE-424

• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/contact-form/module.php#L102Product
• https://plugins.trac.wordpress.org/changeset/3089154Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3a703fc4-6c61-442e-a637-515e9f501575?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/contact-form/module.php#L102Product
• https://plugins.trac.wordpress.org/changeset/3089154Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3a703fc4-6c61-442e-a637-515e9f501575?source=cveThird Party Advisory

Published

May 22, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39248A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 a…5.4
• CVE-2024-39249Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular…7.5
• CVE-2024-3925The Element Pack Elementor Addons (Header Footer, Template L…5.4
• CVE-2024-39250EfroTech Timetrax v8.3 was discovered to contain an unauthen…9.8
• CVE-2024-39251An issue in the component ControlCenter.sys/ControlCenter64.…10
• CVE-2024-3926The Element Pack Elementor Addons (Header Footer, Template L…5.4
• CVE-2024-39271Improper restriction of communication channel to intended en…2.6
• CVE-2024-39272A cross-site scripting (xss) vulnerability exists in the dat…8.2
• CVE-2024-39273A firmware update vulnerability exists in the fw_check.sh fu…8.1
• CVE-2024-39274Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <=…6.5
• CVE-2024-39275Cookies of authenticated Advantech ADAM-5630 users remain as…8.8
• CVE-2024-39276In the Linux kernel, the following vulnerability has been re…5.5