What is the CVSS score of CVE-2026-8118?

CVE-2026-8118 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Royal Addons for Elementor CVE-2026-8118

EUVD-2026-37986 MEDIUM

External Control of File Name or Path (CWE-73)

2026-06-19 Wordfence

GHSA-82gr-q3mv-hrr3

PHP WordPress Information Disclosure Royal Addons For Elementor Addons And Templates Kit For Elementor Wordpress Plugin Wproyal

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via REST endpoint (AV:N), trivial to craft (AC:L), Contributor auth required (PR:L), pure read impact only (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 06:37 vuln.today

CVE Published

Jun 19, 2026 - 04:31 nvd

MEDIUM 6.5

DescriptionCVE.org

The Royal Addons for Elementor - Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.

AnalysisAI

Arbitrary file read in Royal Addons for Elementor versions 1.7.1058-1.7.1059 allows authenticated attackers with Contributor-level access to retrieve the contents of any file readable by the PHP process - including wp-config.php and its database credentials - via a crafted wpr-data-table widget saved through Elementor's save_builder endpoint. The flaw is a regression: the vulnerable wpr_get_csv_handle() helper was itself introduced in version 1.7.1058 as the remediation for a prior CVE (CVE-2026-6229), meaning the security patch introduced a new, exploitable path. No public exploit has been identified at time of analysis, but the low privilege bar (Contributor) and high-value disclosure target (database credentials) elevate real-world risk on WordPress sites that permit open or low-friction contributor registration.

Technical ContextAI

The vulnerability resides in the wpr_get_csv_handle() PHP helper within the Royal Addons for Elementor plugin (CPE: cpe:2.3:a:wproyal:royal_addons_for_elementor_-_addons_and_templates_kit_for_elementor:*:*:*:*:*:*:*:*), a premium Elementor extension providing drag-and-drop widget kits including a data-table widget with CSV import functionality. The root cause is classified as CWE-73 (External Control of File Name or Path): when the attacker-controlled settings.table_upload_csv.url parameter does not parse as an HTTP(S) URL, the function falls back to PHP's native is_readable() and fopen($source, 'r') calls directly against the supplied value. Because there is no allow-list restricting permitted paths, no path traversal sanitization, and no file extension check, an attacker can supply any absolute or relative filesystem path - including /var/www/html/wp-config.php - and the widget's rendered preview will return the file's content line-by-line. The Elementor save_builder REST endpoint is the delivery mechanism, and the vulnerability is exercised at widget render/preview time after the malicious widget definition is persisted.

RemediationAI

Update the Royal Addons for Elementor plugin to the version incorporating changeset 3532747, available via the WordPress Plugin Repository. The upstream fix is confirmed via the Trac changeset at https://plugins.trac.wordpress.org/changeset/3532747/royal-elementor-addons; however, the exact fixed release version number is not explicitly stated in the available data - consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ce047b-3cd3-475b-9a9f-38d15174e7e5 or the plugin's changelog to confirm the minimum safe version before deploying. If immediate patching is not possible, restrict the Contributor role from accessing Elementor's save_builder REST endpoint via a WAF rule or capability filter (trade-off: may break legitimate Contributor content editing). Additionally, ensure WordPress file permissions prevent the PHP process user from reading wp-config.php directly (e.g., chmod 400 and ownership by root rather than the web server user), which mitigates the highest-impact disclosure target even if the vulnerability itself cannot be patched immediately.