WordPress Plugin Vulnerabilities

Royal Elementor Addons < 1.7.1069 - Contributor+ RCE

Description

The plugin is vulnerable to Remote Code Execution due to insufficient validation of user supplied input before it is executed. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary code on the server.

Affects Plugins

Plugin icon
royal-elementor-addons
Fixed in 1.7.1069

References

CVE
CVE-2026-111851
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f1dafafe-91bb-4cd6-93f3-e67538389697

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Intrudify
Verified
No
WPVDB ID
ffa2e709-90d4-4b66-be53-b2e9c3b8116f

Timeline

Publicly Published
2026-10-20 (about 26 days ago)
Added
2026-10-26 (about 20 days ago)
Last Updated
2026-10-26 (about 20 days ago)

Other

Published
Title
Published
2026-08-17
Title
Cwicly <= 1.4.4 - Authenticated (Contributor+) Remote Code Execution
Published
2025-07-01
Title
Alone < 7.8.5 - Unauthenticated Remote Code Execution
Published
2023-01-25
Title
Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
Published
2025-09-16
Title
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
Published
2025-01-15
Title
Motors – Car Dealer, Classifieds & Listing < 1.4.44 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title