What is the CVSS score of CVE-2026-8118?

CVE-2026-8118 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Royal Addons for Elementor CVE-2026-8118

EUVD-2026-37986 MEDIUM

External Control of File Name or Path (CWE-73)

2026-06-19 Wordfence

GHSA-82gr-q3mv-hrr3

PHP WordPress Information Disclosure Royal Addons For Elementor Addons And Templates Kit For Elementor

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via REST endpoint (AV:N), trivial to craft (AC:L), Contributor auth required (PR:L), pure read impact only (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 06:37 vuln.today

CVE Published

Jun 19, 2026 - 04:31 nvd

MEDIUM 6.5

DescriptionCVE.org

The Royal Addons for Elementor - Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.

AnalysisAI

Arbitrary file read in Royal Addons for Elementor versions 1.7.1058-1.7.1059 allows authenticated attackers with Contributor-level access to retrieve the contents of any file readable by the PHP process - including wp-config.php and its database credentials - via a crafted wpr-data-table widget saved through Elementor's save_builder endpoint. The flaw is a regression: the vulnerable wpr_get_csv_handle() helper was itself introduced in version 1.7.1058 as the remediation for a prior CVE (CVE-2026-6229), meaning the security patch introduced a new, exploitable path. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain WordPress Contributor account

Delivery

Craft wpr-data-table widget with local filesystem path as CSV URL

Exploit

POST crafted widget to Elementor save_builder REST endpoint

Execution

wpr_get_csv_handle() bypasses HTTP check and calls fopen() on attacker-supplied path

Persist

Widget preview response returns file contents line-by-line

Impact

Extract database credentials from wp-config.php

Access

Obtain WordPress Contributor account

Delivery

Craft wpr-data-table widget with local filesystem path as CSV URL

Exploit

POST crafted widget to Elementor save_builder REST endpoint

Execution

wpr_get_csv_handle() bypasses HTTP check and calls fopen() on attacker-supplied path

Persist

Widget preview response returns file contents line-by-line

Impact

Extract database credentials from wp-config.php

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid WordPress account with at minimum Contributor-level role - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately characterizes the risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a Contributor account on a target WordPress site running Royal Addons for Elementor 1.7.1058 or 1.7.1059, then crafts a POST request to the Elementor save_builder endpoint containing a wpr-data-table widget whose settings.table_upload_csv.url field is set to an absolute local path such as /var/www/html/wp-config.php. When Elementor renders the widget preview, wpr_get_csv_handle() detects the value is not an HTTP URL and opens the file directly via fopen(), returning the database credentials embedded in wp-config.php line-by-line in the preview response. …
Remediation	Update the Royal Addons for Elementor plugin to the version incorporating changeset 3532747, available via the WordPress Plugin Repository. … Detailed patch versions, workarounds, and compensating controls in full report.