Vulnerability · Published Oct 28, 2026 · Assigned by WPScan

CVE-2026-106647Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision

Low 3.8

In plain English

A low-severity missing authorization in Royal Addons for Elementor from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.2%top 90.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Royal Addons for Elementor	1.3.68 – before 1.7.1070

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/ec572544-dd52-48df-a62e-2edc03614ff4/ exploit, vdb-entry, technical-description