CVE-2026-106648 Details
Description
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
A vulnerability exists in the Royal Elementor Addons WordPress plugin in versions prior to 1.7.1070. The plugin fails to validate form field values before inserting them into the recipient addresses of notification emails. This flaw allows unauthenticated attackers to modify the recipient list and send emails composed by the attacker from the site's domain, provided a recipient field is set to reflect submitted values.
Users are advised to update the Royal Elementor Addons WordPress plugin to version 1.7.1070 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/a93f2619-572d-4432-bf7d-f3f691c30086/ | [email protected] | AdvisoryPartial ContentRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Royal Elementor Addons | < 1.7.1070 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |