Royal Addons CVE-2026-107097

Exploitation requires that the target site has the Royal Addons for Elementor plugin installed at a version in the affected range (1.3.71 to below 1.7.1070) AND has the plugin's Mailchimp integration configured with a stored Mailchimp credential and a reachable subscribe endpoint/audience - without a connected Mailchimp account there is nothing to abuse. Given that precondition, no further conditions apply: the vector is remote and unauthenticated (PR:N/UI:N/AC:L) against the affected feature, with no special user interaction, authentication, or non-default setting needed beyond having the Mailchimp feature enabled. The primary limiting factor is therefore the presence of a configured Mailchimp integration; impact is confined to polluting the owner's Mailchimp audience (integrity), not to the WordPress site itself.

This is a genuine but moderate-severity issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, which maximizes reachability, but the impact is narrow: C:N/I:L/A:N - integrity-only, with no confidentiality or availability loss - yielding a base score of 5.3 (Medium). The supporting signals agree with this moderate posture: EPSS is only 0.15% (4th percentile), there is no CISA KEV listing (not confirmed actively exploited), and the vuln.today Decision label is 'this_month' rather than act_now/emergency. No SSVC exploitation/automatable/technical-impact breakdown is supplied in the input, so that framework cannot be cross-referenced here. The realistic risk is data pollution and abuse of the owner's Mailchimp account (junk/confirmed subscribers, inflated audiences, possible list-reputation and cost consequences) rather than site compromise. Net: a real, easily-reachable flaw worth patching on a routine cycle, not a drop-everything priority. One note of caution - the input Tags label this 'Authentication Bypass', while the CWE (CWE-862) and description describe a missing authorization check; these are related but distinct, and the CWE/description framing should be treated as authoritative.

A remote attacker, without any account or authentication, sends crafted requests to the plugin's Mailchimp subscription handler on a site running Royal Addons for Elementor with the Mailchimp integration configured. Because no authorization check is performed before the plugin uses the site owner's stored Mailchimp credential, the attacker repeatedly injects arbitrary email addresses and contact details into the owner's chosen Mailchimp audience as confirmed subscribers. No working public exploit is identified in the input; a WPScan advisory documents the issue.