Vulnerability in Royal Addons for Elementor – Addons and Templates Kit for Elementor — CVE-2026-106648
MediumSeverity
0.3%Estimated exploit probability
600,000+ sitesInstalls
1.7.1070Fixed in
What to do now
Update Royal Addons for Elementor – Addons and Templates Kit for Elementor to 1.7.1070 or later.
Affected versions
- Everything before 1.7.1070
Affected: Royal Addons for Elementor – Addons and Templates Kit for Elementor (plugin, royal-elementor-addons)
What the vulnerability is
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.