---
id: "CVE-2026-107097"
kind: "vulnerability"
aliases: ["CVE-2026-107097"]
title: "Royal Addons for Elementor: missing authorization lets anyone add Mailchimp subscribers"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "mailchimp", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-mailchimp-integration", "plugin-version-1.7.1070-or-later"]
published_at: "2026-10-28T06:16:32+00:00"
first_seen_at: "2026-10-28T06:31:26+00:00"
updated_at: "2026-10-28T06:32:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107097", "first_seen_at": "2026-10-28T06:31:26+00:00"}]
---

# Royal Addons for Elementor: missing authorization lets anyone add Mailchimp subscribers

The Royal Addons for Elementor WordPress plugin before 1.7.1070 performs no authorization check before using the site's stored Mailchimp credential to add subscribers to an audience chosen by the request. An unauthenticated attacker can insert arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Royal Addons for Elementor plugin in the WordPress admin under Plugins, and confirm it is `1.7.1070` or later.
- Check whether the site has a Mailchimp integration configured in the plugin settings, since the flaw uses the stored Mailchimp credential.
- Review the Mailchimp audience for subscribers added without a matching sign-up form submission.

## Fix

- Update the Royal Addons for Elementor plugin to `1.7.1070` or later.
- If the update cannot be applied, disable the plugin or remove the Mailchimp integration until it is.
- Review and remove any unexpected subscribers added to the Mailchimp audience.

## Timeline

- 2026-10-28T06:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107097

## From the sources

The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_