CVE-2026-8118: Royal Addons Elementor Plugin Arbitrary File Read Vulnerability

Technical summary

CVE-2026-8118 is a path traversal vulnerability in the wpr_get_csv_handle() function introduced in version 1.7.1058 as a mitigation for CVE-2026-6229. The function accepts a user-controlled URL via the settings.table_upload_csv.url parameter when saving a wpr-data-table widget through Elementor's save_builder endpoint. When the input does not parse as a valid HTTP URL, the function falls back to using PHP's is_readable() and fopen() functions directly on the attacker-supplied path with no validation: no allow-list of permitted directories, no traversal sequence filtering, and no file extension restrictions. The rendered widget preview then returns the file's contents line-by-line, enabling arbitrary file disclosure. The vulnerability requires authentication (Contributor role minimum) and user interaction (saving the widget), but both are low barriers in typical WordPress environments.

Business impact

This vulnerability poses a direct confidentiality risk to WordPress sites running the affected plugin versions. Attackers with contributor access—often granted to freelance writers, content managers, or other non-administrative staff—can extract sensitive files without leaving obvious traces in audit logs. Exposure of wp-config.php leaks database credentials, encryption keys, and API tokens, potentially enabling lateral movement, database compromise, or takeover of third-party integrations. For multi-tenant environments or agencies managing client sites, a single compromised contributor account could expose data across multiple properties. The medium CVSS score reflects the authentication requirement, but the sensitivity of files at risk warrants treating this as a priority remediation.

Affected systems

The Royal Addons for Elementor plugin for WordPress is affected in versions 1.7.1058 and 1.7.1059. Any WordPress installation running these specific versions is at risk if the site permits contributor-level user accounts. Sites that restrict widget editing to administrators or editors only have reduced exposure, though privilege escalation vulnerabilities could lower that bar.

Exploitability

Exploitation requires two conditions: authenticated access with Contributor role or above, and the ability to use Elementor's save_builder endpoint to create or modify a wpr-data-table widget. In practice, this means an attacker must either be a legitimate user (disgruntled employee, compromised account) or have obtained contributor credentials through phishing, password reuse, or a prior vulnerability. The attack itself is straightforward—craft a POST request with a malicious CSV file path in the widget settings and retrieve the preview output. No exploit is currently documented in the KEV catalog, but the mechanics are not complex; tooling could emerge quickly once public details become widely known. The technical barrier to exploitation is low for someone with basic HTTP request manipulation skills.

Remediation

Update the Royal Addons for Elementor plugin to a patched version released after 1.7.1059. Verify the specific version number against the vendor's advisory (linked in the patch guidance below). As an immediate interim measure on sites that cannot patch quickly, restrict Elementor editing and widget creation to administrators only, reducing the attacker surface to high-privilege accounts. Additionally, review database access logs and configuration file read attempts for suspicious activity that may indicate exploitation.

Patch guidance

Monitor the Royal Addons plugin repository and vendor advisory channels for release of a patched version addressing CVE-2026-8118. Apply the update as soon as testing confirms compatibility with your site's other plugins and theme. If you maintain a staging environment, test the patch there first to catch any unexpected interactions. Verify the installed version matches the release notes; the vulnerability spans 1.7.1058–1.7.1059, so confirm your version is newer than 1.7.1059. Check the official plugin page and vendor announcements for any additional guidance or rollback instructions.

Detection guidance

Look for POST requests to wp-admin/admin-ajax.php or the Elementor save_builder endpoint that include suspicious file paths in widget settings—particularly paths containing ../ sequences, references to wp-config.php, /etc/passwd, or other sensitive files. Monitor PHP error logs for is_readable() or fopen() calls on unexpected file paths. Check access logs for unusual patterns: rapid requests to save endpoints from a single user, or uploads of CSV files with non-standard paths. File integrity monitoring on wp-config.php and other sensitive files can detect unexpected read access. Correlate authentication logs with widget-saving events to identify whether edits came from expected users and times. Audit user accounts with Contributor role or above; disable or reset credentials of any accounts not in active use.

Why prioritize this

Although the CVSS score is MEDIUM, the files at risk—wp-config.php and similar configuration data—have very high informational sensitivity. The vulnerability requires only low-privilege authentication and affects a popular plugin. Organizations running Royal Addons should prioritize patching within their normal update cycle (days to weeks, not months). The absence from the KEV catalog suggests exploits are not yet widespread in the wild, but this is a narrow window; patch before public tooling emerges.

Risk score, explained

The CVSS v3.1 score of 6.5 (MEDIUM) reflects authentication and user-interaction requirements: AV:N (network attack vector, can be exploited remotely), AC:L (low complexity, no special conditions), PR:L (low-privilege user account needed), UI:N (no user interaction required from the victim—the attacker saves the widget), S:U (scope unchanged), C:H (high confidentiality impact), I:N (no integrity impact), A:N (no availability impact). While the score is not CRITICAL or HIGH, the confidentiality impact is significant because wp-config.php and similar sensitive files contain cryptographic keys and credentials. Organizations should interpret this as a high-priority file disclosure risk despite the moderate CVSS rating.

Frequently asked questions