Is CVE-2026-8118 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8118 being exploited in the wild.

How severe is CVE-2026-8118?

Medium severity, with a CVSS score of 6.5, published 19 June 2026.

Which products and versions are affected?

WPRoyal Royal Addons for Elementor 1.7.1058 - 1.7.1059.

Is there a fix for CVE-2026-8118?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8118 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8118?

Check whether you run WPRoyal Royal Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8118: Royal Addons for Elementor arbitrary file read in wpr_get_csv_handle

CVE-2026-8118 · Severity: medium · CVSS 6.5 · Published 2026-06-19

The Royal Addons for Elementor plugin for WordPress is vulnerable to an arbitrary file read flaw. This plugin provides additional design elements and templates for the Elementor page builder. An attacker with basic contributor-level access can exploit this to view sensitive internal files, such as configuration files containing database credentials, which could lead to a full site takeover.

Technologies: WPRoyal Royal Addons for Elementor. Vendors: WPRoyal.

Quick answers

Is CVE-2026-8118 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8118 being exploited in the wild.
How severe is CVE-2026-8118?: Medium severity, with a CVSS score of 6.5, published 19 June 2026.
Which products and versions are affected?: WPRoyal Royal Addons for Elementor 1.7.1058 - 1.7.1059.
Is there a fix for CVE-2026-8118?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8118 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8118?: Check whether you run WPRoyal Royal Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the wpr_get_csv_handle() helper function, which was introduced as a patch for a previous vulnerability. The function fails to properly validate the 'settings.table_upload_csv.url' parameter; if the value is not a valid HTTP URL, the code falls back to using is_readable() and fopen() on the raw input without path traversal blocks or extension checks. Authenticated attackers with Contributor-level permissions or higher can use the Elementor 'save_builder' endpoint to inject a crafted path into a 'wpr-data-table' widget. When the widget is rendered in a preview, the plugin returns the contents of the specified local file, such as wp-config.php, to the attacker.

Affected products

wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059

Timeline

2026-06-19: disclosed: Vulnerability published by Wordfence and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.