The Royal Addons for Elementor plugin stored a form's email delivery configuration in a global namespace keyed only on an author‑chosen identifier that is exposed to the public. Because the configuration is not scoped to the individual form or its owner, an attacker with the Author role or higher can provide a different value for that identifier on another form, overwriting the existing recipient address. Once overwritten, all submissions to that form will be delivered to the attacker‑controlled email address, enabling phishing and data exfiltration without the owner’s knowledge.

WordPress sites that have the Royal Addons for Elementor plugin installed in any version before 1.7.1070. The specific vendor is listed as Unknown:Royal Addons for Elementor. Owners of sites using this plugin should verify their plugin version and upgrade if necessary.

The vulnerability requires only an Author role or higher, which is commonly granted to content authors. An attacker who can write a form widget will be able to replace another user’s form configuration. The EPSS score is not available, and the flaw is not listed in CISA KEV, indicating no known public exploits yet. However, the potential for data interception is high, and the lack of an access control guard makes this a serious privilege escalation flaw that can be exploited with minimal effort by an insider or compromised account.