CVE-2026-8118 Overview
CVE-2026-8118 is an arbitrary file read vulnerability in the Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress. The flaw affects versions 1.7.1058 through 1.7.1059. Authenticated attackers with Contributor-level access or higher can read any file accessible to the PHP process, including wp-config.php. The weakness resides in the wpr_get_csv_handle() helper, which was introduced in version 1.7.1058 as part of the patch for CVE-2026-6229. The helper falls back to is_readable() and fopen($source, 'r') on attacker-controlled input without an allow-list, traversal block, or extension check. The vulnerability is categorized under [CWE-73] External Control of File Name or Path.
Critical Impact
Authenticated Contributor-level users can exfiltrate sensitive files such as wp-config.php, exposing database credentials and WordPress secret keys.
Affected Products
- Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress
- Plugin version 1.7.1058
- Plugin version 1.7.1059
Discovery Timeline
- 2026-06-19 - CVE-2026-8118 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-8118
Vulnerability Analysis
The Royal Addons plugin exposes a wpr-data-table widget that accepts a CSV source through the settings.table_upload_csv.url parameter. The wpr_get_csv_handle() helper was added in version 1.7.1058 as a remediation for CVE-2026-6229. When the supplied value does not parse as an HTTP URL, the helper treats it as a local path and opens it directly with fopen($source, 'r') after an is_readable() check. The widget then renders the file contents line by line in the preview response.
Root Cause
The root cause is missing input validation on a user-controlled file path. The helper performs no allow-listing of permitted directories, no normalization to block path traversal sequences such as ../, and no extension check to restrict reads to CSV files. Any string that does not match an HTTP URL is accepted as a local filesystem path.
Attack Vector
An authenticated user with Contributor permissions or higher submits a crafted wpr-data-table widget to Elementor's save_builder endpoint. The attacker sets settings.table_upload_csv.url to an absolute or relative path pointing to a sensitive file. Rendering the preview returns the file's contents line by line in the response, allowing extraction of wp-config.php, system files, or any other file readable by the PHP user.
No verified exploit code is publicly available. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-8118
Indicators of Compromise
- POST requests to the Elementor save_builder endpoint containing the wpr-data-table widget with a non-HTTP table_upload_csv.url value.
- table_upload_csv.url values containing absolute filesystem paths, traversal sequences such as ../, or references to wp-config.php.
- Preview responses returning multiline plaintext content that resembles PHP configuration data or /etc/ files.
Detection Strategies
- Inspect WordPress request logs for Contributor-authenticated POSTs to admin-ajax.php invoking Elementor's builder save action with Royal Addons widget payloads.
- Apply web application firewall rules that flag table_upload_csv.url values which are not well-formed HTTP or HTTPS URLs.
- Audit user role assignments and recent contributor activity for unexpected use of data table widgets.
Monitoring Recommendations
- Alert on PHP fopen access to sensitive files such as wp-config.php when initiated by the web server user outside expected workflows.
- Track installed Royal Addons for Elementor plugin versions across WordPress assets and flag instances running 1.7.1058 or 1.7.1059.
- Monitor outbound responses containing fragments of WordPress configuration constants such as DB_PASSWORD or AUTH_KEY.
How to Mitigate CVE-2026-8118
Immediate Actions Required
- Update the Royal Addons for Elementor plugin to the version released in changeset 3532747 or later.
- Audit Contributor and higher accounts, removing or restricting any that are unused or unrecognized.
- Rotate database credentials and WordPress secret keys defined in wp-config.php if exploitation is suspected.
Patch Information
The vendor fix is published in the WordPress plugin repository via WordPress Plugin Update changeset 3532747. The update enforces validation on the CSV source so that local filesystem paths can no longer be supplied through settings.table_upload_csv.url.
Workarounds
- Disable the Royal Addons for Elementor plugin until the patched version is deployed.
- Restrict the Contributor role and above to trusted users only, and remove the edit_posts capability from untrusted roles where feasible.
- Deploy a web application firewall rule that rejects wpr-data-table widget submissions whose table_upload_csv.url field is not an HTTP or HTTPS URL.
# Example: list installed plugin versions and disable Royal Addons via WP-CLI
wp plugin list --name=royal-elementor-addons --fields=name,version,status
wp plugin deactivate royal-elementor-addons
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
