Royal Elementor Addons CVE-2026-106648

Exploitation requires a Royal Elementor Addons form (version before 1.7.1070) whose notification email recipient field is explicitly configured to echo a submitted form value - this is the exact precondition stated in the description and is a non-default setup, so sites using only static/hardcoded recipient addresses are not affected. When that configuration is present, the attack is remote and unauthenticated against a public form (AV:N/PR:N/UI:N), with no further user interaction needed. The limiting factor is therefore the recipient-field-echo configuration rather than authentication; impact is bounded to integrity (email relay/spoofing from the site's domain), with no confidentiality or availability consequence.

This is a moderate, not emergency, issue and the signals are internally consistent. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a network-reachable, unauthenticated, low-complexity flaw whose only impact is a limited integrity effect - the plugin builds notification-email recipient addresses from unvalidated submitted form values, letting an attacker redirect and relay mail from the site's domain; there is no confidentiality or availability impact (C:N/A:N). There is no CISA KEV listing and no EPSS score in the input, so widespread automated exploitation is not evidenced. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so exploit maturity is uncertain. The vuln.today Decision label is 'this_month', consistent with a real but non-critical priority rather than act_now/emergency. The most important caveat is a conditional precondition baked into the description: exploitation only applies 'when a recipient field is configured to echo a submitted value' - a non-default configuration - which the CVSS PR:N/AC:L metrics do not capture. Net: a genuine abuse-of-trust / email-relay and spoofing concern for affected sites that use that configuration, but a bounded-impact (I:L only) issue, not a high-real-risk code-execution or data-breach vulnerability.

On a site running a vulnerable Royal Elementor Addons form whose recipient field is configured to echo a user-submitted value, an unauthenticated attacker submits the public form with a crafted field value that overwrites the notification recipient list. The site's mail server then sends attacker-composed email to attacker-chosen recipients from the site's own domain, enabling spoofing/phishing and mail relay. A public PoC reference exists (WPScan) but is not verified as working exploit code.