Title: Elementor Form Submitted
Last modified: March 6, 2025

---

# Elementor Form Submitted

 *  [bkjproductions](https://wordpress.org/support/users/bkjproductions/)
 * (@bkjproductions)
 * [1 year, 1 month ago](https://wordpress.org/support/topic/elementor-form-submitted/)
 * I have version 5.6.3 of this plugin running on a family-only website, so only
   a few people have access or care to visit. However, twice in the past week someone
   from Russia (two different IPs) has been able to fill out an Elementor form and
   submit it, and an email arrives in my mailbox.
 * However, the site seems locked down for any page request, and I cannot get the
   page with the form to show up without being logged in.
 * Is there some sort of leak whereby a form can be submitted even though the site
   is locked with this plugin? The page URL is whatever.com/about so perhaps there
   is an assumption that there is a contact form there and the hacker is somehow
   submitting based on that.
 * When I look at the way the Elementor form works, it sends a POST to wp-admin/
   admin-ajax.php, and looking at the Request payload via Inspector, I see this:
 *     ```wp-block-code
       ------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="post_id"22444------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="form_id"0eb9680------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="referer_title"About------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="queried_id"22444------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="form_fields[name]"My Name------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="form_fields[email]"info+test@example.com.com------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="form_fields[message]"test------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="action"elementor_pro_forms_send_form------geckoformboundaryffdef58eb7a8d4df9648b727de3798aaContent-Disposition: form-data; name="referrer"https://whatever.com/about/------geckoformboundaryffdef58eb7a8d4df9648b727de3798aa--
       ```
   
 * Perhaps the wp-admin/ajax.php should also be blocked by this plugin?

The topic ‘Elementor Form Submitted’ is closed to new replies.

 * ![](https://ps.w.org/wp-force-login/assets/icon.svg?rev=1904031)
 * [Force Login](https://wordpress.org/plugins/wp-force-login/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wp-force-login/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wp-force-login/)
 * [Active Topics](https://wordpress.org/support/plugin/wp-force-login/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wp-force-login/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wp-force-login/reviews/)

 * 0 replies
 * 1 participant
 * Last reply from: [bkjproductions](https://wordpress.org/support/users/bkjproductions/)
 * Last activity: [1 year, 1 month ago](https://wordpress.org/support/topic/elementor-form-submitted/)
 * Status: not resolved