Vulnerability in Unknown Royal Elementor Addons

[ Description ]Official description

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund26 Oct 2026WID-SEC-2026-4184

  WP Royal Royal Elementor Addons: Multiple vulnerabilities Translated from German

  CVE-2026-97255CVE-2026-97254CVE-2026-106647+5 more CVEs

[ References ]References

• wpscan.com/vulnerability/a93f2619-572d-4432-bf7d-f3f691c30086