# Royal Addons for Elementor <= 1.7.1069 - Authenticated (Contributor+) Arbitrary Function Call via Archive Page Types Display Condition

- **ID:** WPSEC-2026-1587
- **Plugin:** Royal Addons for Elementor – Addons and Templates Kit for Elementor (`royal-elementor-addons`), https://wordpress.org/plugins/royal-elementor-addons/
- **Affected versions:** from 1.7.1053 before 1.7.1070
- **Fixed in:** 1.7.1070 (Update to 1.7.1070 or later.)
- **Severity:** Medium 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-24)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/royal-elementor-addons
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1587/

## Description

The Royal Addons for Elementor plugin for WordPress is vulnerable to limited code execution via the Visibility Conditions 'Archive > Page Types' (wpr_dc_archive_types) setting in versions 1.7.1053 to 1.7.1069, inclusive. This is due to the saved setting values being passed directly to call_user_func() with only a function_exists() check and no allowlist. This makes it possible for authenticated attackers with Contributor-level access and above who can edit content with Elementor to store the name of any existing PHP function. That function is then called without arguments whenever the element is rendered on the front end.

## References

- https://wpsec.com/vuln/WPSEC-2026-1587/
- https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1070/
- https://wordpress.org/plugins/royal-elementor-addons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1587/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.