Is CVE-2026-2385 actively exploited?

No active exploitation of CVE-2026-2385 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-2385 be exploited remotely?

Yes. CVE-2026-2385 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-2385?

CVE-2026-2385 has a CVSS score of 5.3 (MEDIUM) and an EPSS exploitation probability of 0.02%.

HOME VULNERABILITIESCVE-2026-2385

MEDIUM

CVE-2026-2385

CWE-345Published: February 22, 2026· Updated: Feb 23, 2026

5.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.0th

Official Description

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.

NVD Source

Technical Analysis

CVE-2026-2385 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.