CVE-2026-111851 in Royal Elementor Addons Plugin
Summary
by MITRE • 10/22/2026
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Injection.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as an unsafe reflection flaw within the WProyal Royal Elementor Addons plugin, specifically affecting versions up to and including 1.7.1068, represents a critical security risk that allows for remote code execution through improper handling of user-supplied input. This type of vulnerability falls under the category of CWE-470, which describes situations where an application uses externally-controlled input to select or invoke classes or methods via reflection mechanisms without adequate validation or sanitization. In the context of WordPress plugins like Royal Elementor Addons, this often manifests when a developer accepts parameters from GET or POST requests and directly passes them into functions such as call_user_func_array, forward_static_call, or dynamic method invocations within PHP code. Because these constructs allow for the execution of arbitrary methods on instantiated objects, an attacker can manipulate the input to target internal classes that may expose sensitive functionality or execute system commands.
The technical mechanism behind this flaw relies on the flexibility inherent in object-oriented programming languages like PHP, where class names and method names can be determined at runtime rather than being hardcoded statically. When a plugin fails to restrict the set of allowable values for these dynamic inputs, it creates an open door for exploitation. An attacker crafts a malicious request containing specific parameters that correspond to dangerous methods within the WordPress core or other loaded plugins. By leveraging this unsafe reflection, the adversary can bypass standard security controls and execute code with the privileges of the web server process. This is particularly severe in shared hosting environments where multiple sites reside on the same infrastructure, as compromising one site through this vector could potentially lead to lateral movement across the network.
From an operational perspective, the impact of this vulnerability extends far beyond simple data exposure or defacement. Successful exploitation enables a remote attacker to achieve full control over the affected WordPress installation. This includes the ability to read sensitive configuration files such as wp-config.php which contains database credentials and authentication keys, modify website content to inject phishing pages or malware, install backdoors for persistent access, and potentially pivot attacks against other systems on the same network segment. The lack of input validation means that even users with minimal privileges, such as subscribers or contributors who can submit forms or interact with plugin settings, could theoretically trigger this code injection if they have access to specific endpoints exposed by the addon. This significantly lowers the barrier for entry compared to vulnerabilities requiring administrator-level access.
Industry standards classify this issue under MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers command and script interpretation via scripting languages like PHP. The vulnerability also aligns with CWE-20 regarding improper input validation, as the root cause is the failure to verify that user-supplied data conforms to expected formats or allowed values before processing it through reflective mechanisms. Security researchers emphasize that unsafe reflection should be avoided entirely in favor of static method calls whenever possible. If dynamic invocation is strictly necessary for plugin functionality, developers must implement a strict allowlist approach where only predefined class names and methods are permitted, rejecting any input that does not match the whitelist exactly.
Mitigation strategies require immediate action from both site administrators and plugin developers. For users running affected versions of Royal Elementor Addons, the primary remediation is to update the plugin to version 1.7.1069 or later where this flaw has been patched by restricting input validation and removing unsafe reflective calls. Until an update is applied, administrators should consider disabling the specific features that trigger these endpoints if possible, although complete mitigation usually requires updating due to the pervasive nature of reflection flaws in WordPress ecosystems. Additionally, implementing a Web Application Firewall can provide some protection by detecting patterns associated with PHP object injection or dangerous function calls like call_user_func within HTTP requests. Regular security audits and code reviews focusing on dynamic method invocation are essential for preventing similar vulnerabilities in future plugin updates.