CVE-2026-106647— Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision

Quick assessment

Affected

Unknown Royal Addons for Elementor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elementor 的 Royal Addons 插件在 1.7.1070 版本之前存在安全漏洞：该插件未将联系表单的邮件发送配置限制在表单自身的文档或所有者范围内，而是将其存储在仅以非机密、由作者自定义的标识符为键的站点全局命名空间中。该标识符会暴露在公开页面源代码中，导致拥有“作者”（Author）角色或更高权限的用户能够覆盖其他用户的表单配置，从而将表单提交内容发送至攻击者控制的邮箱地址。

AI Predicted 6.5 Difficulty: Easy Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Updated Oct 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision

Source: CVE Program / CVE List V5

Vulnerability Description

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Royal Addons for Elementor	1.3.68 ~ 1.7.1070	-

II. Public POCs for CVE-2026-106647

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-106647

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-106647

Same Patch Batch · Unknown · 2026-10-28 · 42 CVEs total

CVE-2026-110508	5.3 MEDIUM	Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypas
CVE-2026-106648	5.3 MEDIUM	Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vi
CVE-2026-103330	5.3 MEDIUM	Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature
CVE-2026-103313	5.3 MEDIUM	BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Retur
CVE-2026-115223	4.9 MEDIUM	Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVE-2026-110691		WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update
CVE-2026-103331		UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via
CVE-2026-110524		Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode
CVE-2026-110509		Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via
CVE-2026-107100		Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclos
CVE-2026-110506		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
CVE-2026-110292		PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Can
CVE-2026-110507		Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop
CVE-2026-106002		Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
CVE-2026-106003		Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion
CVE-2026-107098		Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widge
CVE-2026-107097		Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection vi
CVE-2026-103382		Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confi
CVE-2026-103688		Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
CVE-2026-105972		WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribu

Showing top 20 of 42 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Royal Addons for Elementor

Same vendor: Unknown