CVE-2026-106648: Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Royal Elementor Addonsto a version that resolves this vulnerability.Fixed in 1.7.1070
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Royal Elementor Addons versions earlier than 1.7.1070 are exposed when a form notification recipient field is configured to echo a submitted form value.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need access to a vulnerable form whose recipient configuration substitutes a submitted field value into the notification recipient address.
What is the practical impact of successful exploitation?
An attacker can replace the notification recipient list and cause the site to relay attacker-composed email from the site's own domain. The reported impact is limited to integrity; no confidentiality or availability impact is specified.
How can I determine whether my configuration is affected?
Check whether the plugin version is earlier than 1.7.1070, then review form notification settings for recipient fields that echo or substitute values submitted through the form. Forms without that recipient-field configuration are not described as affected.