Arbitrary File Read Vulnerability in Royal Addons for Elementor Plugin by WordPress

CVE-2026-8118

What is CVE-2026-8118?

The Royal Addons for Elementor plugin for WordPress is susceptible to an Arbitrary File Read vulnerability due to improper handling of user-controlled input in the wpr_get_csv_handle() function. This issue arises from the fallback mechanism that fails to adequately validate the settings.table_upload_csv.url parameter, allowing authenticated users with Contributor-level permissions or higher to exploit the plugin. By manipulating the wpr-data-table widget and utilizing Elementor's save_builder endpoint, attackers can retrieve the contents of any file accessible by the PHP process, including sensitive files like wp-config.php, posing significant security risks to affected installations.

References