{
 "id": "WPSEC-2026-1586",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1586/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1586/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1586/index.md",
 "title": "Royal Addons for Elementor <= 1.7.1069 - Unauthenticated Missing Authorization to Mailchimp Subscription and Subscriber Data Exposure via 'listId' Parameter",
 "description": "The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized use of the site's Mailchimp API key via the 'mailchimp_subscribe' and 'wpr_form_builder_mailchimp' AJAX actions in all versions up to, and including, 1.7.1069. This is due to both handlers accepting any caller-supplied 'listId' without checking that it matches the audience configured on a published widget (the 'mailchimp_subscribe' handler also had no nonce check), and the Form Builder handler returning the raw Mailchimp member record to the caller. This makes it possible for unauthenticated attackers to subscribe or re-subscribe arbitrary email addresses to any audience on the site owner's Mailchimp account and to view the Mailchimp member data returned for those addresses.",
 "plugin": {
  "slug": "royal-elementor-addons",
  "name": "Royal Addons for Elementor",
  "full_name": "Royal Addons for Elementor – Addons and Templates Kit for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/royal-elementor-addons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/royal-elementor-addons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/royal-elementor-addons"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.1070",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.1070"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.1070",
 "remediation": "Update to 1.7.1070 or later.",
 "fix_released": "2026-10-23T07:34:01+00:00",
 "published": "2026-10-24T07:43:16+00:00",
 "updated": "2026-10-23T09:48:22.372115+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1586/",
  "https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/",
  "https://wordpress.org/plugins/royal-elementor-addons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/royal-elementor-addons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-24"
 }
}