This vulnerability stems from unsafe reflection – the plugin accepts externally controlled input and uses it to instantiate classes or execute code. Because of this flaw, an attacker can inject or force execution of arbitrary PHP code, giving full control over the WordPress site. The weakness is classified as CWE-470, which covers unsafe use of user-controlled inputs to invoke code, leading to potential compromise of confidentiality, integrity, and availability.

Affected products are the Royal Elementor Addons plugin from WProyal, versions up to and including 1.7.1068. All installations of the plugin that have not yet applied the patch (1.7.1069 or later) are vulnerable, regardless of the WordPress core or other plugins installed.

The CVSS v3 base score is 7.6, indicating a high severity. No EPSS score is provided, so the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, but given the nature of code injection, an attacker who can interact with the affected plugin via a web request could trigger the flaw. The primary attack vector is likely remote, through a crafted HTTP request that leverages the plugin’s parameter handling.