WordPress DynamicKit for Elementor plugin < 1.0.3 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin DynamicKit for Elementor versions 1.0.3...

CVE-2026-14596

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-14596

The DynamicKit for Elementor WordPress plugin (versions before 1.0.3 ) is vulnerable to an unauthenticated account takeover due to a lack of host validation on user-supplied URLs. Attackers can inject an attacker-controlled host into the base of the password-reset link sent via email. When a vict...

CVE-2026-14596

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

EUVD-2026-51720

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

CVE-2026-14596 DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...

PT-2026-67045

Name of the Vulnerable Software and Affected Versions DynamicKit for Elementor versions prior to 1.0.3 Description An issue exists where the plugin fails to validate the host of a user-supplied URL used as the base for password-reset emails. This allows unauthenticated attackers to send a target...

CVE-2026-14596: Improper Authentication

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an...