{"id":"CVE-2026-107097","kind":"vulnerability","aliases":["CVE-2026-107097"],"related":[],"title":"Royal Addons for Elementor: missing authorization lets anyone add Mailchimp subscribers","description":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.","summary":"The Royal Addons for Elementor WordPress plugin before 1.7.1070 performs no authorization check before using the site's stored Mailchimp credential to add subscribers to an audience chosen by the request. An unauthenticated attacker can insert arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","mailchimp","package","self-hosted","wordpress"],"not_affected_if":["no-mailchimp-integration","plugin-version-1.7.1070-or-later"],"how_to_check":"- Check the installed version of the Royal Addons for Elementor plugin in the WordPress admin under Plugins, and confirm it is `1.7.1070` or later.\n- Check whether the site has a Mailchimp integration configured in the plugin settings, since the flaw uses the stored Mailchimp credential.\n- Review the Mailchimp audience for subscribers added without a matching sign-up form submission.","fix":"- Update the Royal Addons for Elementor plugin to `1.7.1070` or later.\n- If the update cannot be applied, disable the plugin or remove the Mailchimp integration until it is.\n- Review and remove any unexpected subscribers added to the Mailchimp audience.","status":"open","published_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","triaged_at":"2026-10-28T06:32:48+00:00","updated_at":"2026-10-28T06:32:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Royal Addons for Elementor plugin to `1.7.1070` or later.\n- If the update cannot be applied, disable the plugin or remove the Mailchimp integration until it is.\n- Review and remove any unexpected subscribers added to the Mailchimp audience.","reach":"internet","title":"Royal Addons for Elementor: missing authorization lets anyone add Mailchimp subscribers","impact":"low","summary":"The Royal Addons for Elementor WordPress plugin before 1.7.1070 performs no authorization check before using the site's stored Mailchimp credential to add subscribers to an audience chosen by the request. An unauthenticated attacker can insert arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","mailchimp","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attackers add arbitrary subscribers to the owner's Mailchimp account.","analyst_note":"","how_to_check":"- Check the installed version of the Royal Addons for Elementor plugin in the WordPress admin under Plugins, and confirm it is `1.7.1070` or later.\n- Check whether the site has a Mailchimp integration configured in the plugin settings, since the flaw uses the stored Mailchimp credential.\n- Review the Mailchimp audience for subscribers added without a matching sign-up form submission.","needs_analyst":false,"not_affected_if":["plugin-version-1.7.1070-or-later","no-mailchimp-integration"],"who_is_affected":"Sites running the Royal Addons for Elementor plugin before `1.7.1070` that have a Mailchimp credential stored are exposed, because the plugin uses that credential for unauthenticated requests. Sites without the plugin or without a stored Mailchimp credential are not affected by this flaw as described.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":3335,"output_tokens":708,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107097':14A,17A '-2026':13A,16A '1.7.1070':33B,85C 'account':73B,129C 'add':9A,47B,102C 'addon':2A,27B,79C 'address':63B,119C 'allow':112C 'anyon':8A 'arbitrari':61B,117C 'attack':58B,114C 'audienc':51B,107C 'author':6A,36B,90C 'check':37B,91C 'chosen':52B,108C 'confirm':75B,131C 'contact':65B,121C 'credenti':45B,100C 'cve':12A,15A 'detail':66B,122C 'elementor':4A,18B,29B,81C 'email':62B,118C 'host':23B 'inject':116C 'insert':60B 'let':7A 'mailchimp':10A,19B,44B,72B,99C,128C 'miss':5A 'owner':70B,96C,126C 'packag':20B 'perform':34B,88C 'plugin':31B,83C 'record':104C 'request':55B,111C 'royal':1A,26B,78C 'self':22B 'self-host':21B 'site':41B,69B,95C,125C 'store':43B,98C 'subscrib':11A,48B,76B,103C,132C 'unauthent':57B,113C 'use':39B,93C 'wordpress':24B,30B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Royal Addons for Elementor plugin before `1.7.1070` that have a Mailchimp credential stored are exposed, because the plugin uses that credential for unauthenticated requests. Sites without the plugin or without a stored Mailchimp credential are not affected by this flaw as described.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107097","severity":null,"published_at":"2026-10-28T06:16:32+00:00","modified_at":"2026-10-28T06:16:32+00:00","first_seen_at":"2026-10-28T06:31:26+00:00","fetched_at":"2026-10-28T06:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}