CVE-2026-106647: low-severity vulnerability in Royal Addons for Elementor
Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 3.8epss 0.2%
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected products
Unknown · Royal Addons for Elementorpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/ec572544-dd52-48df-a62e-2edc03614ff4/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Royal Addons for Elementor
In the same product, most dangerous first.
CVE-2026-19226MEDIUMRoyal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect SettingsEPSS 0.4%CVE-2026-13405MEDIUMRoyal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget BuilderEPSS 0.4%CVE-2026-13402MEDIUMRoyal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template DisclosureEPSS 0.3%CVE-2026-13406MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term DisclosureEPSS 0.3%CVE-2026-107098MEDIUMRoyal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height SettingEPSS 0.3%CVE-2026-13404MEDIUMRoyal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_initEPSS 0.3%