Royal Addons for Elementor <= 1.7.1069 - Authenticated (Contributor+) Arbitrary Function Call via Archive Page Types Display Condition
- ID
- WPSEC-2026-1587
- Plugin
- Royal Addons for Elementor – Addons and Templates Kit for Elementor (royal-elementor-addons)
- Affected
- from 1.7.1053 before 1.7.1070
- Remediation
- Update to 1.7.1070 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-24
- Attack surface
- Royal Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Royal Addons for Elementor plugin for WordPress is vulnerable to limited code execution via the Visibility Conditions 'Archive > Page Types' (wpr_dc_archive_types) setting in versions 1.7.1053 to 1.7.1069, inclusive. This is due to the saved setting values being passed directly to call_user_func() with only a function_exists() check and no allowlist. This makes it possible for authenticated attackers with Contributor-level access and above who can edit content with Elementor to store the name of any existing PHP function. That function is then called without arguments whenever the element is rendered on the front end.
References
- https://wpsec.com/vuln/WPSEC-2026-1587/
- https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/
- https://wordpress.org/plugins/royal-elementor-addons/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS