CVE-2026-13405: CWE-94 Improper Control of Generation of Code ('Code Injection') in Royal Addons for Elementor

The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1066 contain a CWE-94 improper control of code generation vulnerability. Specifically, the plugin fails to sanitize custom widget markup before writing it to a file that is executed later. This enables users with the manage_options capability, and on multisite setups, non-super subsite administrators without other code execution privileges, to execute arbitrary PHP code on the server. This vulnerability can lead to unauthorized code execution within the WordPress environment.

Successful exploitation allows users with elevated WordPress privileges (manage_options capability) to execute arbitrary PHP code on the server. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or further pivoting within the hosting environment. The vulnerability affects multisite installations by expanding the threat to subsite administrators who normally lack code execution capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, restrict the manage_options capability to trusted users only, and monitor for suspicious activity related to custom widget markup. Avoid granting elevated privileges to untrusted users, especially on multisite installations.