# Royal Addons for Elementor <= 1.7.1069 - Unauthenticated Missing Authorization to Mailchimp Subscription and Subscriber Data Exposure via 'listId' Parameter

- **ID:** WPSEC-2026-1586
- **Plugin:** Royal Addons for Elementor – Addons and Templates Kit for Elementor (`royal-elementor-addons`), https://wordpress.org/plugins/royal-elementor-addons/
- **Affected versions:** all versions before 1.7.1070
- **Fixed in:** 1.7.1070 (Update to 1.7.1070 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-24)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/royal-elementor-addons
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1586/

## Description

The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized use of the site's Mailchimp API key via the 'mailchimp_subscribe' and 'wpr_form_builder_mailchimp' AJAX actions in all versions up to, and including, 1.7.1069. This is due to both handlers accepting any caller-supplied 'listId' without checking that it matches the audience configured on a published widget (the 'mailchimp_subscribe' handler also had no nonce check), and the Form Builder handler returning the raw Mailchimp member record to the caller. This makes it possible for unauthenticated attackers to subscribe or re-subscribe arbitrary email addresses to any audience on the site owner's Mailchimp account and to view the Mailchimp member data returned for those addresses.

## References

- https://wpsec.com/vuln/WPSEC-2026-1586/
- https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/
- https://wordpress.org/plugins/royal-elementor-addons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1586/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.