CVE-2025-10873 - OpenCVE

The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Elementinvader	Elementinvader Addons For Elementor
Elementor	Elementor
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/2eb133db-e1c5-409e-94f8-b71edca5db16/

History

Thu, 06 Nov 2025 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Elementinvader Elementinvader elementinvader Addons For Elementor Elementor Elementor elementor Wordpress Wordpress wordpress
Vendors & Products		Elementinvader Elementinvader elementinvader Addons For Elementor Elementor Elementor elementor Wordpress Wordpress wordpress

Wed, 05 Nov 2025 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 05 Nov 2025 06:15:00 +0000

Type	Values Removed	Values Added
Description		The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.
Title		Elementinvader Addons for Elementor < 1.4.1 – Unauthenticated Arbitrary Email Sending
References		https://wpscan.com/vulnerability/2eb133db-e1c5-409e-94f8-b71edca5db16/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2025-11-05T06:00:06.600Z

Updated: 2025-11-05T18:38:43.461Z

Reserved: 2025-09-23T12:21:49.391Z

Link: CVE-2025-10873

Vulnrichment

Updated: 2025-11-05T18:38:33.743Z

NVD

Status : Awaiting Analysis

Published: 2025-11-05T06:15:32.870

Modified: 2025-11-06T19:45:30.990

Link: CVE-2025-10873

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10873", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-09-23T12:21:49.391Z", "datePublished": "2025-11-05T06:00:06.600Z", "dateUpdated": "2025-11-05T18:38:43.461Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-11-05T06:00:06.600Z"}, "title": "Elementinvader Addons for Elementor < 1.4.1 \u2013 Unauthenticated Arbitrary Email Sending", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "ElementInvader Addons for Elementor", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.4.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action."}], "references": [{"url": "https://wpscan.com/vulnerability/2eb133db-e1c5-409e-94f8-b71edca5db16/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Lucas Montes", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T18:38:40.292214Z", "id": "CVE-2025-10873", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T18:38:43.461Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-10873", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T18:38:40.292214Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T18:38:33.743Z"}}], "cna": {"title": "Elementinvader Addons for Elementor < 1.4.1 \u2013 Unauthenticated Arbitrary Email Sending", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "ElementInvader Addons for Elementor", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/2eb133db-e1c5-409e-94f8-b71edca5db16/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-11-05T06:00:06.600Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10873", "state": "PUBLISHED", "dateUpdated": "2025-11-05T18:38:43.461Z", "dateReserved": "2025-09-23T12:21:49.391Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-11-05T06:00:06.600Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}