CVE-2026-8118

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.

• CWE-73

• https://plugins.trac.wordpress.org/changeset/3532747/royal-elementor-addons
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ce047b-3cd3-475b-9a9f-38d15174e7e5?source=cve

Published

Jun 19, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8112A vulnerability was found in 8421bit MiniClaw up to 223c16a1…8.8
• CVE-2026-8113A vulnerability was determined in 8421bit MiniClaw up to 439…6.5
• CVE-2026-8114A vulnerability was identified in JeecgBoot up to 3.9.1. Aff…6.3
• CVE-2026-8115A security flaw has been discovered in gyoridavid short-vide…5.5
• CVE-2026-8116A weakness has been identified in huangjunsen0406 xiaozhi-mc…6.3
• CVE-2026-8117A security vulnerability has been detected in SourceCodester…4.3
• CVE-2026-8119A vulnerability was detected in Open5GS up to 2.7.7. Impacte…5.5
• CVE-2026-8120A flaw has been found in Open5GS up to 2.7.7. The affected e…6.5
• CVE-2026-8121A vulnerability has been found in Open5GS up to 2.7.7. The i…6.5
• CVE-2026-8122A vulnerability was found in Open5GS up to 2.7.7. This affec…6.5
• CVE-2026-8123A vulnerability was determined in Open5GS up to 2.7.7. This …6.5
• CVE-2026-8124A security vulnerability has been detected in GPAC up to 26.…5.5