Email Relay Vulnerability in Royal Elementor Addons for WordPress
CVE-2026-106648

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Royal Elementor Addons
Vendor
CVE Published:
28 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-106648?

The Royal Elementor Addons plugin for WordPress, prior to version 1.7.1070, contains a security flaw where it fails to properly validate form field values before incorporating them into email recipient addresses. This issue allows unauthenticated attackers to alter the intended recipient list and send emails composed by the attacker from the site’s domain. This vulnerability poses risks to site integrity and user trust, as it could facilitate phishing attacks or unauthorized communications leveraging the site's credibility.

Affected Version(s)

Royal Elementor Addons 0 < 1.7.1070

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-106648 - Proof of Concept

References

https://wpscan.com/vulnerability/a93f2619-572d-4432-bf7d-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammed Abd Alrahman
WPScan
.