CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-106648?
CVE-2026-106648 is a medium-severity vulnerability in Unknown Royal Elementor Addons, published on 28 Oct 2026.
Official description
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
Weakness: CWE-74
Which versions are affected by CVE-2026-106648?
How do I fix CVE-2026-106648?
No fix has been published for CVE-2026-106648 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-106648 being exploited?
There is no known exploitation of CVE-2026-106648 in the wild and no public exploit code.
Sources
Also known as GHSA-qc47-xccv-ch2q.