What is the CVSS score of EUVD-2026-108071?

EUVD-2026-108071 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-108071?

Within 24 hours, inventory all WordPress installations and confirm whether Royal Elementor Addons versions through 1.7.1068 are installed and active; where feasible, temporarily disable the plugin until a fixed version is released, and in parallel aggressively audit user accounts, removing any unnecessary low-privileged accounts and enforcing strong authentication for remaining users. Within 7 days, apply virtual patching through a web application firewall (WAF) with rules targeting unsafe reflection and class-selection manipulation if your WAF vendor offers them, and restrict administrative access to trusted networks while monitoring for suspicious code execution or file changes. Within 30 days, track the vendor for a patched version (no fixed release identified at time of analysis) and test and deploy it immediately upon availability; if the plugin cannot be removed, document a formal risk acceptance with compensating controls and consider replacing the plugin with a maintained alternative.

Royal Elementor Addons EUVD-2026-108071

| CVE-2026-111851 HIGH

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)

2026-10-22 Patchstack

GHSA-gh3g-hm6p-x4v6

WordPress Code Injection Royal Elementor Addons Wordpress Plugin Wproyal

7.6

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privilege WordPress user
Delivery

Send request with attacker-controlled class input
Exploit

Trigger unsafe reflection in plugin
Execution

Inject and execute code
Impact

Compromise WordPress site

Vulnerability Assessment

Weakness	CWE CWE-470 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V15 - Secure Coding and Architecture Reflection safety, class allowlisting
Exploitation Conditions	Exploitation requires the Royal Elementor Addons plugin (version n/a through 1.7.1068) installed and active on a WordPress site, plus a low-privileged authenticated session (PR:L) - exploitation is not fully unauthenticated. The flaw stems from externally-controlled input used to select classes or code (unsafe reflection), but the available sources do not name the exact endpoint, parameter, or configuration that supplies the attacker-controlled class, so the precise trigger is not described in the available sources. Limiting factors: an attacker must first obtain some authenticated account on the target site, and the target must run an affected plugin version; no user interaction is required (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L).
Impact	Signals are mixed and partly incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring some level of authenticated privilege (PR:L), with no user interaction. The vuln.today decision label is 'this_week' (an elevated but non-emergency priority), and the issue was reported by Patchstack, a reputable WordPress-vulnerability source. However, no EPSS exploitation-probability score was provided, there is no CISA KEV listing, and the single reference is a Patchstack database entry rather than verified working exploit code - so widespread or confirmed active exploitation is NOT established. The CWE-470 unsafe-reflection / code-injection class is high-impact when reachable, and the Patchstack reference title characterizes it as 'arbitrary code execution', which is more severe than the supplied impact metrics (C:L/I:L/A:H) suggest - this discrepancy should be verified with the vendor/Patchstack. Net: a genuine this-week patching priority for sites running Royal Elementor Addons due to the code-execution potential and low attack complexity, but NOT a drop-everything emergency on current evidence given the authentication requirement (PR:L), absence of EPSS/KEV data, and an unverified PoC.
Exploit ScenarioDerived	An attacker holding a low-privileged authenticated WordPress account (the PR:L in the vector) on a site running Royal Elementor Addons ≤ 1.7.1068 sends a crafted request whose externally-controlled input selects an attacker-chosen class or code path, exploiting the unsafe-reflection flaw to inject and execute code. A public PoC reference exists (Patchstack database entry); it is not verified as working exploit code. The exact trigger (which parameter/endpoint controls the reflected class) is not described in the available sources.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 22, 2026

Unsafe reflection in the WordPress plugin Royal Elementor Addons (all versions through 1.7.1068) allows code injection: externally controlled input is used to select which class or code path the plugin executes, so a low-privileged authenticated user can push the site toward attacker-chosen code execution. The plugin must be installed and active, and the attacker needs a valid account on the site first, but no user interaction is required and the attack is network-reachable at low complexity (CVSS 3.1 base score 7.6; assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the available sources do not name the exact endpoint, parameter or configuration that supplies the attacker-controlled class value.

RemediationAI

No vendor-released patch is identified in the available data. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1068-arbitrary-code-execution-vulnerability?_s_id=cve is the reference to track and should be checked for a fixed release above 1.7.1068 before upgrading; the provided data does not state an exact fix version, so none should be assumed. Because exploitation requires an active plugin plus a low-privileged authenticated account, the exposure can be reduced in the interim by deactivating Royal Elementor Addons until a patched build is confirmed (the trade-off is the loss of its Elementor widgets and templates on the site) and by reviewing which user roles can register or be issued accounts on the site, tightening that set to the minimum needed (the trade-off is reduced self-service or delegated editing for legitimate users). Neither measure removes the underlying unsafe class-resolution code, so they are containment steps only, and this CVE is prioritized as this_week.

Affected VersionsENISA

Royal Elementor Addons 0 ≤1.7.1068

Affected Packages

euvd royal_elementor_addons no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the WordPress plugin royal-elementor-addons (CPE cpe:2.3:a:wproyal:royal_elementor_addons:*:*:*:*:*:*:*:*), a PHP-based widget/extension pack for the Elementor page builder published by WProyal, with the vulnerable range extending from n/a through 1.7.1068. The root cause class is CWE-470, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): a PHP code path takes a value that an attacker can influence and uses it to resolve a class name or dispatch to code, rather than choosing from a fixed, hard-coded allowlist. In PHP this pattern arises where dynamic instantiation or callable resolution (for example class-name strings built from request data) is fed by user-supplied input, letting an attacker pivot from data into executable code within the WordPress process. The available sources do not describe the specific request flow, parameter, or configuration that supplies the attacker-controlled class, so the precise trigger is not described in the available sources; what is confirmed is that a low-privileged authenticated session (PR:L) suffices, that the attack is network-reachable with low complexity and no user interaction, and that the assessed impact is high across confidentiality, integrity and availability.

Know when Royal Elementor Addons gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

vuln.today AI 8.8 HIGH

Network-reachable, low-complexity flaw needing a low-privilege account (PR:L, no UI); unsafe-reflection code injection enables arbitrary code execution, so full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

DescriptionCVE.org

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.

Executive ViewAI

Why It Matters

The Royal Elementor Addons WordPress plugin, used across many marketing and corporate sites, contains an unsafe reflection vulnerability that lets low-privileged authenticated users inject and potentially execute arbitrary code on the web server. Because the attacker must first have a valid account (e.g., a subscriber, contributor, or compromised credential), the primary organizational risk is insider misuse or privilege escalation from a minor account to full site compromise - which can lead to data theft, defacement, or lateral movement into backend systems. Leadership should care because a single compromised low-level user on any site running this plugin could become a full breach, and no vendor patch exists yet, leaving risk exposure open-ended.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the Royal Elementor Addons plugin through version 1.7.1068 if not business-critical; strictly limit and audit all WordPress user accounts to prevent low-privileged access; deploy WAF rules targeting code injection and unsafe reflection; monitor logs for anomalous file changes or unexpected code execution; and apply least-privilege principles to all site users.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

Medium

popular WordPress Elementor addon plugin, common but not universal

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.