---
id: "CVE-2026-106647"
kind: "vulnerability"
aliases: ["CVE-2026-106647"]
title: "Royal Addons for Elementor: contact form mail redirected by Author-role users"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-contact-form-widget", "plugin-updated", "single-trusted-editor"]
published_at: "2026-10-28T06:16:32+00:00"
first_seen_at: "2026-10-28T06:31:26+00:00"
updated_at: "2026-10-28T06:32:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106647", "first_seen_at": "2026-10-28T06:31:26+00:00"}]
---

# Royal Addons for Elementor: contact form mail redirected by Author-role users

The Royal Addons for Elementor WordPress plugin stores contact form email settings in a site-wide namespace keyed on a public, author-chosen identifier. A user with the Author role or above can overwrite another user's form configuration and send that form's submissions to an address they control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Royal Addons for Elementor version in the WordPress plugins screen or with `wp plugin get royal-elementor-addons --field=version`
- unknown for other checks; the sources do not describe a configuration setting or file to inspect

## Fix

- Update Royal Addons for Elementor to `1.7.1070` or later
- unknown for other mitigations; the sources do not name one

## Timeline

- 2026-10-28T06:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106647

## From the sources

The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_