Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1070 - Unauthenticated Unauthorized Email Relay

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to 1.7.1070. This is due to missing validation on user-supplied values substituted into email recipient address templates, allowing submitted field values containing commas or multiple addresses to replace or augment the configured recipient list. This makes it possible for unauthenticated attackers to send email from the site's own mail infrastructure to arbitrary recipients by injecting additional addresses through a submitted form field that is echoed into the To, Cc, or Bcc headers. A Form Builder widget must be configured with a recipient field (To, Cc, or Bcc) that uses a [id="..."] shortcode referencing a submitted form field.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Royal Addons for Elementor 1.7.1070 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts