Royal Addons EUVD-2026-111705

Requires an authenticated account with the WordPress Author role or above on the target site, and the target site must run Royal Addons for Elementor between 1.3.68 and before 1.7.1070 with a contact form whose email-delivery config is keyed on a non-secret, author-chosen identifier exposed in public page source. The attacker reads that identifier from the victim page's public source and overwrites the site-global configuration entry. Limiting factors: the attacker must already hold an Author+ account, so sites that do not provision such accounts to untrusted users (e.g. single-administrator installs) are effectively unexposed; only sites using the plugin's contact-form email feature are affected, and the victim form's identifier must be discoverable in public output.

All signals point to a low real-world priority. The input CVSS base score is 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N), EPSS is 0.15% (4th percentile), there is no CISA KEV listing, no public exploit code is identified, and the vuln.today decision label is 'monitor' - these are mutually consistent and indicate a non-urgent issue. One internal discrepancy is worth flagging: the supplied vector uses PR:H, but the description says exploitation is available to 'the Author role or above,' which in WordPress is an ordinary authenticated low-privilege user, not an administrator - so PR:L is the more honest metric, which would raise the score modestly (~5.3) without changing the overall low/medium picture. The flaw is a missing-authorization / insecure-direct-object-reference problem (CWE-862): the email-delivery config is stored in a site-global namespace keyed on a non-secret, author-chosen identifier that is exposed in public page source, so any Author+ user can overwrite another user's form configuration. Realistic exposure is confined to multi-author or membership WordPress sites that actually grant Author-or-above accounts to semi-trusted users; single-admin sites face negligible risk because the attacker precondition (an untrusted Author account) does not exist. The confidentiality impact (capturing another user's form submissions at an attacker-controlled address) and integrity impact (tampering the config) are both rated Low. Net: a genuine broken-access-control bug but a targeted, low-probability threat, not a widespread emergency.

On a multi-author WordPress site running Royal Addons for Elementor, an attacker holding an Author account opens the public source of a victim's published page to recover the form's non-secret, author-chosen identifier, then submits a crafted configuration that overwrites the site-global email-delivery setting for that identifier. Subsequent submissions to the victim's contact form are then delivered to the attacker's address. No public exploit code is identified at time of analysis; the scenario is plausible given AV:N/AC:L and the low barrier of reading the identifier from page source.