Vulnerability in Unknown Royal Addons for Elementor

[ Description ]Official description

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund26 Oct 2026WID-SEC-2026-4184

  WP Royal Royal Elementor Addons: Multiple vulnerabilities Translated from German

  CVE-2026-97255CVE-2026-97254CVE-2026-106647+5 more CVEs

[ References ]References

• wpscan.com/vulnerability/57461fb8-4a81-47e6-aa91-44bde1993d9a