5.3
MediumCVSS 3.1 · from WPScan
CVE-2026-106648
Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
Royal Elementor Addons · Injection · CWE-74AffectedRoyal Elementor Addons
FixUpdate to 1.7.1070 or newer
PublishedOct 28, 10:45 · WPScan
ScoredOct 28 · 5.3 · WPScan
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
From WPScan
Affected and fixed versions
ProductAffectedFixed inRoyal Elementor Addonsbefore 1.7.10701.7.1070
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known