Description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Royal Addons for Elementor | < 1.7.1066 | 1.7.1066 |
Advisories 1
- WID-SEC-2026-2942 WP Royal Royal Elementor Addons: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 19, 2026
References
- https://wpscan.com/vulnerability/247be7fc-a49f-429e-875d-8649510c42b5/ exploit vdb-entry technical-description