---
id: CVE-2026-107097
title: >-
  Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience
  Injection via mailchimp_subscribe
summary: >-
  The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not
  perform any authorization check before using the site owner's stored Mailchimp
  credential to add subscriber records to an audience chosen by the request,
  allowing …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: Royal Addons for Elementor
affected:
  - royal_addons_for_elementor >= 1.3.71 < 1.7.1070
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:47:52.926512Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:08.091Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107097'
references:
  - url: 'https://wpscan.com/vulnerability/57461fb8-4a81-47e6-aa91-44bde1993d9a/'
tags:
  - cve.org
epss: 0.00153
epssPercentile: 0.04421
ingestedAt: '2026-10-28T07:06:27.150Z'
---

## Overview

The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

## Affected

- `royal_addons_for_elementor >= 1.3.71 < 1.7.1070`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.