{"api_version":"1","generated_at":"2026-10-28T08:02:13+00:00","cve":"CVE-2026-106647","urls":{"html":"https://cve.report/CVE-2026-106647","api":"https://cve.report/api/cve/CVE-2026-106647.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-106647","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-106647"},"summary":{"title":"Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision","description":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-10-28 06:16:32","updated_at":"2026-10-28 06:16:32"},"problem_types":["CWE-862 Missing Authorization"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/ec572544-dd52-48df-a62e-2edc03614ff4/","name":"https://wpscan.com/vulnerability/ec572544-dd52-48df-a62e-2edc03614ff4/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106647","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106647","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Royal Addons for Elementor","version":"affected 1.3.68 1.7.1070 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Mohammed Abd Alrahman","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Royal Addons for Elementor","vendor":"Unknown","versions":[{"lessThan":"1.7.1070","status":"affected","version":"1.3.68","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Mohammed Abd Alrahman"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address."}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-28T06:00:21.875Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/ec572544-dd52-48df-a62e-2edc03614ff4/"}],"source":{"discovery":"EXTERNAL"},"title":"Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-106647","datePublished":"2026-10-28T06:00:21.875Z","dateReserved":"2026-10-07T03:55:17.175Z","dateUpdated":"2026-10-28T06:00:21.875Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-28 06:16:32","lastModifiedDate":"2026-10-28 06:16:32","problem_types":["CWE-862 Missing Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"106647","Ordinal":"1","Title":"Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submissi","CVE":"CVE-2026-106647","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"106647","Ordinal":"1","NoteData":"The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with the Author role or above to overwrite another user's form configuration and have that form's submissions delivered to an attacker-controlled address.","Type":"Description","Title":"Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submissi"}]}}}