Live › vulnerability › CVE-2026-106648
Go to dashboardThe Royal Elementor Addons WordPress plugin does not validate form field values before placing them into the recipient addresses of form notification emails. An unauthenticated visitor can replace the recipient list and send attacker-written email from the site's own domain when a recipient field is set to echo a submitted value.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Sites running Royal Elementor Addons before 1.7.1070 with at least one form whose notification recipient is configured to take a submitted field value. Sites without the plugin, or with fixed recipient addresses only, are not exposed to this flaw.
No product ranges from the sources yet.
wp plugin get royal-elementor-addons --field=version1.7.1070 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
This page as .md · .json · in your agent: get_signal("CVE-2026-106648")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.