CVE-2026-106647 Details
Description
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.
A vulnerability exists in the Royal Addons for Elementor WordPress plugin in versions prior to 1.7.1070. The issue arises because the plugin does not associate a contact form's email delivery settings with the specific form or its owner. Instead, it uses a site-wide namespace that is only keyed by a non-secret, user-chosen identifier, which is visible in the public page source. This flaw enables users with Author roles or higher to overwrite another user's form settings, redirecting that form's submissions to an email address controlled by the attacker.
Users are advised to update the Royal Addons for Elementor WordPress plugin to version 1.7.1070 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/ec572544-dd52-48df-a62e-2edc03614ff4/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Royal Addons | >= 1.3.68, <= 1.7.1069 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |