Royal Addons for Elementor <= 1.7.1069 - Unauthenticated Missing Authorization to Mailchimp Subscription and Subscriber Data Exposure via 'listId' Parameter
- ID
- WPSEC-2026-1586
- Plugin
- Royal Addons for Elementor – Addons and Templates Kit for Elementor (royal-elementor-addons)
- Affected
- all versions before 1.7.1070
- Remediation
- Update to 1.7.1070 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-24
- Attack surface
- Royal Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized use of the site's Mailchimp API key via the 'mailchimp_subscribe' and 'wpr_form_builder_mailchimp' AJAX actions in all versions up to, and including, 1.7.1069. This is due to both handlers accepting any caller-supplied 'listId' without checking that it matches the audience configured on a published widget (the 'mailchimp_subscribe' handler also had no nonce check), and the Form Builder handler returning the raw Mailchimp member record to the caller. This makes it possible for unauthenticated attackers to subscribe or re-subscribe arbitrary email addresses to any audience on the site owner's Mailchimp account and to view the Mailchimp member data returned for those addresses.
References
- https://wpsec.com/vuln/WPSEC-2026-1586/
- https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/
- https://wordpress.org/plugins/royal-elementor-addons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS