Live › vulnerability › CVE-2026-107097
Go to dashboardThe Royal Addons for Elementor WordPress plugin before 1.7.1070 performs no authorization check before using the site's stored Mailchimp credential to add subscribers to an audience chosen by the request. An unauthenticated attacker can insert arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Royal Addons for Elementor plugin before that have a Mailchimp credential stored are exposed, because the plugin uses that credential for unauthenticated requests. Sites without the plugin or without a stored Mailchimp credential are not affected by this flaw as described.
1.7.1070No product ranges from the sources yet.
1.7.1070 or later.1.7.1070 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
This page as .md · .json · in your agent: get_signal("CVE-2026-107097")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.