CVE-2026-8118 Path traversal in Royal Addons for Elementor – Addons and Templates Kit for Elementor
Authenticated contributors can read arbitrary files, including wp-config.php, via a path traversal vulnerability in the Data Table widget's CSV source handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8118?
CVE-2026-8118 is a medium-severity path traversal vulnerability in wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor, published on 19 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.
Weakness: CWE-73
Which versions are affected by CVE-2026-8118?
How do I fix CVE-2026-8118?
No fix has been published for CVE-2026-8118 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-8118 being exploited?
There is no known exploitation of CVE-2026-8118 in the wild and no public exploit code.
Sources
Also known as GHSA-82gr-q3mv-hrr3.