Live › vulnerability › CVE-2026-106647
Go to dashboardThe Royal Addons for Elementor WordPress plugin stores contact form email settings in a site-wide namespace keyed on a public, author-chosen identifier. A user with the Author role or above can overwrite another user's form configuration and send that form's submissions to an address they control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Royal Addons for Elementor plugin before that use its contact form widget. Exposure depends on having multiple users with the Author role or above, since the attacker must be an account holder who can edit the forms. Sites with only one trusted editor are at lower risk.
1.7.1070No product ranges from the sources yet.
wp plugin get royal-elementor-addons --field=version1.7.1070 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.
This page as .md · .json · in your agent: get_signal("CVE-2026-106647")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.