What is GHSA-w3vc-5h78-6ggp?

GHSA-w3vc-5h78-6ggp is a security advisory published by GitHub Security Advisories with Medium severity. The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any...

Which CVE IDs does GHSA-w3vc-5h78-6ggp cover?

GHSA-w3vc-5h78-6ggp covers the following CVE IDs: CVE-2026-107097. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w3vc-5h78-6ggp?

GHSA-w3vc-5h78-6ggp has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-w3vc-5h78-6ggpMediumCVSS 5.3

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any...

Vendor

GitHub Security Advisories

Published

October 28, 2026

Last Modified

October 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-107097 →

📋 Description

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-107097
https://wpscan.com/vulnerability/57461fb8-4a81-47e6-aa91-44bde1993d9a
https://github.com/advisories/GHSA-w3vc-5h78-6ggp