CVE-2026-8118 is an arbitrary file read vulnerability in the Royal Addons for Elementor – Addons and Templates Kit for Elementor WordPress plugin, affecting versions 1.7.1058 through 1.7.1059. The issue arises from the wpr_get_csv_handle() helper function, introduced in version 1.7.1058, which falls back to using is_readable() and fopen() on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL. There is no allow-list, traversal block, or extension check, enabling authenticated attackers with Contributor-level or higher privileges to craft a wpr-data-table widget and retrieve contents of any file readable by the PHP process, including sensitive configuration files like wp-config.php. No official patch or remediation level has been published yet.

An attacker with Contributor-level or higher access can read arbitrary files on the server, potentially exposing sensitive information such as database credentials stored in wp-config.php. This compromises confidentiality but does not affect integrity or availability. The vulnerability requires authentication and does not involve user interaction beyond the attacker’s own actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the wpr-data-table widget. Avoid using affected plugin versions 1.7.1058 and 1.7.1059 if possible.