{"id":"CVE-2026-106647","kind":"vulnerability","aliases":["CVE-2026-106647"],"related":[],"title":"Royal Addons for Elementor: contact form mail redirected by Author-role users","description":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.","summary":"The Royal Addons for Elementor WordPress plugin stores contact form email settings in a site-wide namespace keyed on a public, author-chosen identifier. A user with the Author role or above can overwrite another user's form configuration and send that form's submissions to an address they control.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["no-contact-form-widget","plugin-updated","single-trusted-editor"],"how_to_check":"- Check the installed Royal Addons for Elementor version in the WordPress plugins screen or with `wp plugin get royal-elementor-addons --field=version`\n- unknown for other checks; the sources do not describe a configuration setting or file to inspect","fix":"- Update Royal Addons for Elementor to `1.7.1070` or later\n- unknown for other mitigations; the sources do not name one","status":"open","published_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:49+00:00","updated_at":"2026-10-28T06:32:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update Royal Addons for Elementor to `1.7.1070` or later\n- unknown for other mitigations; the sources do not name one","reach":"network","title":"Royal Addons for Elementor: contact form mail redirected by Author-role users","impact":"medium","summary":"The Royal Addons for Elementor WordPress plugin stores contact form email settings in a site-wide namespace keyed on a public, author-chosen identifier. A user with the Author role or above can overwrite another user's form configuration and send that form's submissions to an address they control.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Form submissions with visitor data get sent to an attacker's email address.","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version details and whether the flaw needs a particular form setting enabled.","how_to_check":"- Check the installed Royal Addons for Elementor version in the WordPress plugins screen or with `wp plugin get royal-elementor-addons --field=version`\n- unknown for other checks; the sources do not describe a configuration setting or file to inspect","needs_analyst":true,"not_affected_if":["plugin-updated","no-contact-form-widget","single-trusted-editor"],"who_is_affected":"Sites running the Royal Addons for Elementor plugin before `1.7.1070` that use its contact form widget. Exposure depends on having multiple users with the Author role or above, since the attacker must be an account holder who can edit the forms. Sites with only one trusted editor are at lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":3356,"output_tokens":597,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106647':16A,19A '-2026':15A,18A '1.7.1070':86C 'addon':2A,28B,80C 'address':75B,159C 'allow':132C 'anoth':62B,142C 'attack':157C 'attacker-control':156C 'author':11A,49B,56B,122C,136C 'author-chosen':48B,121C 'author-rol':10A 'chosen':50B,123C 'configur':66B,96C,146C 'contact':5A,34B,91C 'control':77B,158C 'cve':14A,17A 'deliv':153C 'deliveri':95C 'document':102C 'elementor':4A,20B,30B,82C 'email':36B,94C 'expos':127C 'form':6A,35B,65B,70B,92C,99C,145C,150C 'global':112C 'host':24B 'identifi':51B,124C 'instead':105C 'key':44B,114C 'mail':7A 'namespac':43B,113C 'non':119C 'non-secret':118C 'overwrit':61B,141C 'owner':104C 'packag':21B 'page':130C 'plugin':32B,84C 'public':47B,129C 'redirect':8A 'role':12A,57B,137C 'royal':1A,27B,79C 'scope':89C 'secret':120C 'self':23B 'self-host':22B 'send':68B 'set':37B 'site':41B,111C 'site-glob':110C 'site-wid':40B 'sourc':131C 'store':33B,106C 'submiss':72B,152C 'user':13A,53B,63B,133C,143C 'wide':42B 'wordpress':25B,31B,83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Royal Addons for Elementor plugin before `1.7.1070` that use its contact form widget. Exposure depends on having multiple users with the Author role or above, since the attacker must be an account holder who can edit the forms. Sites with only one trusted editor are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106647","severity":null,"published_at":"2026-10-28T06:16:32+00:00","modified_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}