CVE-2026-8118 Details
Description
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.
A vulnerability allowing arbitrary file read has been identified in the Royal Addons for Elementor plugin for WordPress, specifically in versions 1.7.1058 through 1.7.1059. The issue arises from the wpr_get_csv_handle() helper, which, when the settings.table_upload_csv.url value does not parse as an HTTP URL, falls back to is_readable() and fopen() without any allow-list, traversal block, or extension check. This flaw enables authenticated attackers with Contributor-level access and above to exploit the vulnerability by saving a crafted wpr-data-table widget through Elementor's save_builder endpoint. The rendered preview can then be manipulated to display the contents of any file accessible by the PHP process, including sensitive files like wp-config.php.
Users are advised to update the Royal Addons for Elementor plugin to version 1.7.1060 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Royal Addons | >= 1.7.1058, <= 1.7.1059 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |