Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/57461fb8-4a81-47e6-aa91-44bde1993d9a İstismar kodu ya da analiz

Kayıt geçmişi

1. 28 Eki 2026 21:10CVSS puanı değişti: – → 5.3
2. 28 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 6,8 CVE-2026-107098Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting
• 5,3 CVE-2026-107100Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content
• 3,8 CVE-2026-106647Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
• 6,5 CVE-2026-105620PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
• 5,7 CVE-2026-105618PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent
• 4,8 CVE-2026-105619PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views