CVE-2026-106648
Deferred Deferred - Pending Action

Unauthenticated Email Recipient Manipulation in Royal Elementor Addons

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: WPScan

Description
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-106648
EUVD
EUVD-2026-111971

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Royal Elementor Addons 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated arbitrary email recipient injection in the Royal Elementor Addons WordPress plugin before version 1.7.1070. Attackers can manipulate form field values to replace the intended recipient list in email notifications, allowing them to send emails from the site's domain without authentication.

Detection Guidance

Check the installed version of the Royal Elementor Addons plugin. If it is below 1.7.1070, the system is vulnerable. Inspect form submissions for unexpected recipient values in email notifications.

Impact Analysis

Attackers could use this flaw to send phishing emails or spam from your website's domain, potentially damaging your reputation or tricking users into believing the emails are legitimate. It may also allow unauthorized data exfiltration if combined with other vulnerabilities.

Mitigation Strategies

Update the Royal Elementor Addons plugin to version 1.7.1070 or later immediately. Review form configurations to ensure recipient fields do not echo submitted values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart