PT-2026-127823

CVE-2026-107097

·

Published

2026-10-28

·

Updated

2026-10-28

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.
Exploitability
Exploit
Vendors
Affected products
Related identifiers
CVE-2026-107097
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com