Improper Email Configuration in Royal Addons for Elementor by WP
CVE-2026-106647
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 October 2026
Badges
What is CVE-2026-106647?
The Royal Addons for Elementor plugin for WordPress, up to version 1.7.1070, contains a flaw in the configuration of contact form email delivery. It improperly scopes the email settings to a global namespace based on a publicly accessible identifier chosen by the author. This oversight allows users with an Author role or higher to modify another user's email configuration. As a result, form submissions could be redirected to an email address controlled by an attacker, potentially leading to unauthorized access and data exfiltration.
Affected Version(s)
Royal Addons for Elementor 1.3.68 < 1.7.1070
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.