CVE-2026-107097

MediumCVSS 5.3/10Last modified Oct 28, 2026

Description

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 28, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1070986.8The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before c CVE-2026-10714.4The Carta Online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, CVE-2026-107107.8A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::Ext CVE-2026-1071005.3The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning CVE-2026-1071029.3This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls CVE-2026-1071039.3This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. A CVE-2026-1071049.3This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthen CVE-2026-107118.8Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows A CVE-2026-107126.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 CVE-2026-1071205.3The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verificat CVE-2026-1071216.5A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak CVE-2026-1071237.5A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs