---
id: "CVE-2026-106648"
kind: "vulnerability"
aliases: ["CVE-2026-106648"]
title: "Royal Elementor Addons WordPress plugin: form input lets attackers redirect email"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-28T11:17:14+00:00"
first_seen_at: "2026-10-28T11:32:27+00:00"
updated_at: "2026-10-28T11:33:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106648", "first_seen_at": "2026-10-28T11:32:27+00:00"}]
---

# Royal Elementor Addons WordPress plugin: form input lets attackers redirect email

The Royal Elementor Addons WordPress plugin does not validate form field values before placing them into the recipient addresses of form notification emails. An unauthenticated visitor can replace the recipient list and send attacker-written email from the site's own domain when a recipient field is set to echo a submitted value.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Royal Elementor Addons version in the WordPress plugins screen or `wp plugin get royal-elementor-addons --field=version`
- Look for Elementor forms whose email recipient field uses a form field placeholder such as a submitted value

## Fix

- Update Royal Elementor Addons to `1.7.1070` or later
- Until updated, set form email recipients to fixed addresses instead of submitted field values

## Timeline

- 2026-10-28T11:32:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106648

## From the sources

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_