What is CVE-2026-2385?

CVE-2026-2385 is a medium-severity vulnerability in The Plus Addons for Elementor plugin for WordPress, affecting versions up to 6.4.7. It allows unauthenticated attackers to exploit an insufficient verification of data authenticity in an AJAX handler, enabling unauthorized email relay and redirection.

How does the vulnerability work?

The vulnerability exists because the plugin decrypts attacker-controlled data without verifying its authenticity. An attacker can send a specially crafted request to the AJAX handler, manipulating the email routing and redirection values, which could lead to unauthorized emails being sent or users being redirected to malicious sites.

Who is affected by this vulnerability?

Any WordPress site using The Plus Addons for Elementor plugin versions 6.4.7 or earlier is vulnerable. Site administrators should check their plugin version in the WordPress dashboard to determine if they are affected.

How can I check if my site is vulnerable?

To check if your site is vulnerable, navigate to the Plugins section in your WordPress admin panel. Look for The Plus Addons for Elementor and verify the version number; if it is 6.4.7 or earlier, your site is at risk.

How can I fix this vulnerability?

The vulnerability is patched in version 6.4.8 of The Plus Addons for Elementor. To mitigate the issue, update the plugin to the latest version immediately through the WordPress admin panel.

What does the CVSS score of 5.3 mean?

A CVSS score of 5.3 indicates a medium severity vulnerability. While it may not be critical, it poses a significant risk, as it allows unauthorized actions that could lead to data loss or compromise.

What are the practical risks associated with this vulnerability?

Exploitation of this vulnerability can lead to unauthorized email relay, allowing attackers to send spam or phishing emails that appear to originate from the victim’s domain. It can also enable redirection of users to malicious sites, posing risks to user security.

What is the proof of concept for this vulnerability?

The proof of concept demonstrates how an attacker could structure a request to exploit the vulnerability. It highlights the need for knowledge of the site’s encryption keys, which would typically be obtained through other vulnerabilities or site analysis.

What changes were made in the patched version?

In version 6.4.8, the plugin’s decryption function was rewritten to use AES-256-GCM, which provides authenticated encryption. This change ensures that any tampered data cannot be processed without detection, significantly improving security.

Are there any additional steps I should take after updating?

After updating to the patched version, it is advisable to review your site’s security settings and monitor for any suspicious activity. Regularly updating all plugins and themes is a good practice to prevent future vulnerabilities.

Can this vulnerability be exploited without authentication?

Yes, this vulnerability can be exploited by unauthenticated attackers, meaning that no login or special permissions are required to execute the exploit, making it particularly dangerous.

What should I do if I cannot update the plugin immediately?

If you cannot update the plugin immediately, consider disabling the plugin temporarily to prevent exploitation. Additionally, review your site’s security measures and monitor for any unusual activity until the update can be applied.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-2385: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 – Unauthenticated Email Relay (the-plus-addons-for-elementor-page-builder)

CVE ID CVE-2026-2385

Plugin the-plus-addons-for-elementor-page-builder

Severity Medium (CVSS 5.3)

CWE 345

Vulnerable Version 6.4.7

Patched Version 6.4.8

Disclosed February 20, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-2385:
The vulnerability is an unauthenticated email relay and redirection flaw in The Plus Addons for Elementor plugin. The core issue resides in an insufficiently protected AJAX handler that processes and decrypts attacker-controlled data, allowing manipulation of email routing and form redirection.

Atomic Edge research identifies the root cause in the plugin’s `L_tp_plus_simple_decrypt` function within `/includes/plus_addon.php`. This function decrypts data provided via the `email_data` parameter without verifying its authenticity or origin. The AJAX handler `tp_ajax_action`, which calls this decryption function, lacks authentication checks. An attacker can submit arbitrary encrypted data to this handler, which the plugin will decrypt and trust, treating the contents as legitimate configuration for email routing and redirection.

The exploitation method involves an unauthenticated POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `tp_ajax_action`. The attacker must also include a crafted `email_data` parameter containing encrypted data. This payload is constructed by encrypting a malicious configuration that alters email recipients or form redirection URLs. The plugin’s decryption function processes this data, and the handler uses the tampered values to send emails to attacker-controlled addresses or redirect users to malicious sites.

The patch in version 6.4.8 fundamentally changes the cryptographic implementation. The `L_tp_plus_simple_decrypt` function is rewritten to use AES-256-GCM, which provides authenticated encryption. The function now generates a random initialization vector (IV) and an authentication tag during encryption. During decryption, it validates the tag before returning plaintext, ensuring data integrity. The function also returns `false` if decryption fails, preventing the processing of tampered data. This change ensures the `email_data` parameter cannot be modified without detection.

Successful exploitation allows an unauthenticated attacker to relay arbitrary emails through the vulnerable WordPress site. Attackers can specify any recipient address in email forms, enabling spam or phishing campaigns that appear to originate from the victim’s domain. The vulnerability also permits manipulation of form submission redirections, potentially leading users to malicious websites. This constitutes a loss of confidentiality and integrity for the email system and a vector for client-side attacks.

Differential between vulnerable and patched code

Code Diff

--- a/the-plus-addons-for-elementor-page-builder/includes/plus_addon.php
+++ b/the-plus-addons-for-elementor-page-builder/includes/plus_addon.php
@@ -144,25 +144,58 @@
  * @since 6.0.4
  */
 function L_tp_plus_simple_decrypt( $string, $action = 'dy' ) {
-	// you may change these values to your own
-	$tppk      = get_option( 'theplus_purchase_code' );
-	$generated = ! empty( get_option( 'tp_key_random_generate' ) ) ? get_option( 'tp_key_random_generate' ) : 'PO$_key';
-
-	$secret_key = ( isset( $tppk['tp_api_key'] ) && ! empty( $tppk['tp_api_key'] ) ) ? $tppk['tp_api_key'] : $generated;
-	$secret_iv  = 'PO$_iv';
-
-	$output         = false;
-	$encrypt_method = 'AES-128-CBC';
-	$key            = hash( 'sha256', $secret_key );
-	$iv             = substr( hash( 'sha256', $secret_iv ), 0, 16 );
-
-	if ( $action == 'ey' ) {
-		$output = base64_encode( openssl_encrypt( $string, $encrypt_method, $key, 0, $iv ) );
-	} elseif ( $action == 'dy' ) {
-		$output = openssl_decrypt( base64_decode( $string ), $encrypt_method, $key, 0, $iv );
+
+	$option_name_key = 'tp_key_random_generate';
+    $secret_key = get_option( $option_name_key );
+
+	if ( empty( $secret_key ) ) {
+        $secret_key = wp_generate_password( 32, true, true );
+        add_option( $option_name_key, $secret_key, '', 'no' );
+    }
+
+	$key = hash( 'sha256', $secret_key, true );
+    $cipher = 'aes-256-gcm';
+
+	if ( $action === 'ey' ) {
+        $iv = random_bytes(12);
+        $tag = '';
+
+        $ciphertext = openssl_encrypt( $string, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag);
+
+        if ( false === $ciphertext ) {
+            return false;
+        }
+
+        $encoded = base64_encode( $iv . $tag . $ciphertext );
+		$encoded = str_replace( ['+', '/', '='], ['-', '_', ''], $encoded );
+		return $encoded;
+    } elseif ( $action === 'dy' ) {
+
+		$string = str_replace( ['-', '_'], ['+', '/'], $string );
+
+		$padding = strlen($string) % 4;
+		if ($padding) {
+			$string .= str_repeat('=', 4 - $padding);
+		}
+
+        $decoded = base64_decode( $string, true );
+
+        if ( false === $decoded || strlen($decoded) < 28 ) {
+			return false;
+		}
+
+        $iv  = substr( $decoded, 0, 12 );
+        $tag = substr( $decoded, 12, 16 );
+        $ciphertext = substr( $decoded, 28 );
+
+		if ( empty( $iv ) || empty( $tag ) || empty( $ciphertext ) ) {
+            return false;
+        }
+
+        return openssl_decrypt( $ciphertext, $cipher, $key, OPENSSL_RAW_DATA, $iv, $tag );
 	}

-	return $output;
+	return false;
 }

 /**
--- a/the-plus-addons-for-elementor-page-builder/modules/controls/theme-builder/tpae-class-nxt-download.php
+++ b/the-plus-addons-for-elementor-page-builder/modules/controls/theme-builder/tpae-class-nxt-download.php
@@ -123,40 +123,59 @@

 			check_ajax_referer( 'tp_nxt_install', 'security' );

-			if ( ! current_user_can( 'edit_posts' ) ) {
-				$response = $this->tpae_response('Invalid Permission.', 'Something went wrong.',false );
+			$post_type = isset( $_POST['post_type'] ) ? sanitize_key( $_POST['post_type'] ) : 'elementor_library';
+			$page_type = isset( $_POST['page_type'] ) ? sanitize_text_field( $_POST['page_type'] ) : 'tp_header';
+			$page_name = isset( $_POST['page_name'] ) ? sanitize_text_field( $_POST['page_name'] ) : 'theplus-addon';
+
+			$allowed_post_types = array( 'elementor_library', 'nxt_builder' );
+			if ( ! in_array( $post_type, $allowed_post_types, true ) ) {
+				$response = $this->tpae_response( 'Invalid Post Type', 'The selected post type is not allowed.', false );

 				wp_send_json( $response );
 				wp_die();
 			}

-			$post_type = isset( $_POST['post_type'] ) ? sanitize_text_field( $_POST['post_type'] ) : 'elementor_library';
-			$page_type = isset( $_POST['page_type'] ) ? sanitize_text_field( $_POST['page_type'] ) : 'tp_header';
-			$page_name = isset( $_POST['page_name'] ) ? sanitize_text_field( $_POST['page_name'] ) : 'theplus-addon';
+			$post_type_object = get_post_type_object( $post_type );
+			if ( ! $post_type_object ) {
+				$response = $this->tpae_response( 'Post Type Not Found', 'The requested post type does not exist.', false );
+
+				wp_send_json( $response );
+				wp_die();
+			}
+
+			if ( ! current_user_can( $post_type_object->cap->create_posts ) ) {
+				$response = $this->tpae_response( 'Permission Denied', 'You do not have permission to create this content.', false );

-			$post_args = array(
-				'post_type'   => $post_type,
-				'post_title'  => $page_name,
-				'post_status' => 'draft',
+				wp_send_json( $response );
+				wp_die();
+			}
+
+			$post_id = wp_insert_post(
+				array(
+					'post_type'   => $post_type,
+					'post_title'  => $page_name,
+					'post_status' => 'draft',
+				)
 			);

-			$post_id = wp_insert_post( $post_args );
+			if ( is_wp_error( $post_id ) ) {
+				$response = $this->tpae_response( 'Creation Failed', 'Failed to create the post. Please try again.', false );
+
+				wp_send_json( $response );
+				wp_die();
+			}

 			if ( $post_type === 'nxt_builder' ) {
-				if ( $post_id && ! is_wp_error( $post_id ) ) {
-					update_post_meta( $post_id, 'template_type', $page_type );
-					update_post_meta( $post_id, 'nxt-hooks-layout-sections', $page_type );
-				}
+				update_post_meta( $post_id, 'template_type', $page_type );
+				update_post_meta( $post_id, 'nxt-hooks-layout-sections', $page_type );
 			} elseif ( $post_type === 'elementor_library' ) {
-				if ( $post_id && ! is_wp_error( $post_id ) ) {
-					update_post_meta( $post_id, '_elementor_template_type', $page_type );
-				}
+				update_post_meta( $post_id, '_elementor_template_type', $page_type );
 			}

 			$elementor_edit_url = admin_url( 'post.php?post=' . $post_id . '&action=elementor' );

 			$response = $this->tpae_response(
-				'',
+				'Page Created Successfully', 'Your template has been created successfully.',
 				true,
 				array(
 					'post_id'  => $post_id,
@@ -165,6 +184,7 @@
 			);

 			wp_send_json( $response );
+			wp_die();
 		}


--- a/the-plus-addons-for-elementor-page-builder/theplus_elementor_addon.php
+++ b/the-plus-addons-for-elementor-page-builder/theplus_elementor_addon.php
@@ -3,7 +3,7 @@
  * Plugin Name: The Plus Addons for Elementor
  * Plugin URI: https://theplusaddons.com/
  * Description: Highly Customisable 120+ Advanced Elementor Widgets & Extensions for Performance Driven Website.
- * Version: 6.4.7
+ * Version: 6.4.8
  * Author: POSIMYTH
  * Author URI: https://posimyth.com/
  * Text Domain: tpebl
@@ -20,7 +20,7 @@
 	exit;
 }

-define( 'L_THEPLUS_VERSION', '6.4.7' );
+define( 'L_THEPLUS_VERSION', '6.4.8' );
 define( 'L_THEPLUS_FILE', __FILE__ );
 define( 'L_THEPLUS_PATH', plugin_dir_path( __FILE__ ) );
 define( 'L_THEPLUS_PBNAME', plugin_basename( __FILE__ ) );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2385 - The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay

<?php

$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php';

// The exploit requires the ability to encrypt a payload that the vulnerable plugin will decrypt.
// The original vulnerable encryption uses AES-128-CBC with a static IV and a key derived from options.
// Without knowing the site's specific `theplus_purchase_code` or `tp_key_random_generate` option values,
// we cannot generate a valid `email_data` payload externally.
// Therefore, a full external PoC is not feasible.
// An attacker would first need to extract the secret key via another vulnerability or by analyzing the site.
// This script demonstrates the request structure only.

$payload = array(
    'action' => 'tp_ajax_action',
    'email_data' => 'ENCRYPTED_PAYLOAD_HERE' // Requires internal key knowledge.
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo $response;

?>

Frequently Asked Questions

What is CVE-2026-2385?
Understanding the vulnerability
CVE-2026-2385 is a medium-severity vulnerability in The Plus Addons for Elementor plugin for WordPress, affecting versions up to 6.4.7. It allows unauthenticated attackers to exploit an insufficient verification of data authenticity in an AJAX handler, enabling unauthorized email relay and redirection.
How does the vulnerability work?
Mechanics of exploitation
The vulnerability exists because the plugin decrypts attacker-controlled data without verifying its authenticity. An attacker can send a specially crafted request to the AJAX handler, manipulating the email routing and redirection values, which could lead to unauthorized emails being sent or users being redirected to malicious sites.
Who is affected by this vulnerability?
Identifying impacted users
Any WordPress site using The Plus Addons for Elementor plugin versions 6.4.7 or earlier is vulnerable. Site administrators should check their plugin version in the WordPress dashboard to determine if they are affected.
How can I check if my site is vulnerable?
Version verification
To check if your site is vulnerable, navigate to the Plugins section in your WordPress admin panel. Look for The Plus Addons for Elementor and verify the version number; if it is 6.4.7 or earlier, your site is at risk.
How can I fix this vulnerability?
Updating the plugin
The vulnerability is patched in version 6.4.8 of The Plus Addons for Elementor. To mitigate the issue, update the plugin to the latest version immediately through the WordPress admin panel.
What does the CVSS score of 5.3 mean?
Understanding risk levels
A CVSS score of 5.3 indicates a medium severity vulnerability. While it may not be critical, it poses a significant risk, as it allows unauthorized actions that could lead to data loss or compromise.
What are the practical risks associated with this vulnerability?
Potential impacts
Exploitation of this vulnerability can lead to unauthorized email relay, allowing attackers to send spam or phishing emails that appear to originate from the victim’s domain. It can also enable redirection of users to malicious sites, posing risks to user security.
What is the proof of concept for this vulnerability?
Demonstrating the exploit
The proof of concept demonstrates how an attacker could structure a request to exploit the vulnerability. It highlights the need for knowledge of the site’s encryption keys, which would typically be obtained through other vulnerabilities or site analysis.
What changes were made in the patched version?
Improvements in security
In version 6.4.8, the plugin’s decryption function was rewritten to use AES-256-GCM, which provides authenticated encryption. This change ensures that any tampered data cannot be processed without detection, significantly improving security.
Are there any additional steps I should take after updating?
Post-update measures
After updating to the patched version, it is advisable to review your site’s security settings and monitor for any suspicious activity. Regularly updating all plugins and themes is a good practice to prevent future vulnerabilities.
Can this vulnerability be exploited without authentication?
Access requirements
Yes, this vulnerability can be exploited by unauthenticated attackers, meaning that no login or special permissions are required to execute the exploit, making it particularly dangerous.
What should I do if I cannot update the plugin immediately?
Mitigation strategies
If you cannot update the plugin immediately, consider disabling the plugin temporarily to prevent exploitation. Additionally, review your site’s security measures and monitor for any unusual activity until the update can be applied.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations