{
 "id": "WPSEC-2026-1587",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1587/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1587/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1587/index.md",
 "title": "Royal Addons for Elementor <= 1.7.1069 - Authenticated (Contributor+) Arbitrary Function Call via Archive Page Types Display Condition",
 "description": "The Royal Addons for Elementor plugin for WordPress is vulnerable to limited code execution via the Visibility Conditions 'Archive > Page Types' (wpr_dc_archive_types) setting in versions 1.7.1053 to 1.7.1069, inclusive. This is due to the saved setting values being passed directly to call_user_func() with only a function_exists() check and no allowlist. This makes it possible for authenticated attackers with Contributor-level access and above who can edit content with Elementor to store the name of any existing PHP function. That function is then called without arguments whenever the element is rendered on the front end.",
 "plugin": {
  "slug": "royal-elementor-addons",
  "name": "Royal Addons for Elementor",
  "full_name": "Royal Addons for Elementor – Addons and Templates Kit for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/royal-elementor-addons/",
  "advisories_url": "https://wpsec.com/vuln/plugin/royal-elementor-addons/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/royal-elementor-addons"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.7.1053",
    "from_inclusive": true,
    "to": "1.7.1070",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.7.1053 before 1.7.1070"
  ]
 },
 "introduced_in": "1.7.1053",
 "fixed_in": "1.7.1070",
 "remediation": "Update to 1.7.1070 or later.",
 "fix_released": "2026-10-23T07:34:01+00:00",
 "published": "2026-10-24T07:43:16+00:00",
 "updated": "2026-10-23T09:48:22.372115+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1587/",
  "https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/",
  "https://wordpress.org/plugins/royal-elementor-addons/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/royal-elementor-addons",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-24"
 }
}