CVE-2026-8118 is an arbitrary file read vulnerability in the Royal Addons for Elementor – Addons and Templates Kit for Elementor WordPress plugin. Introduced in version 1.7.1058 as part of a patch for a previous vulnerability (CVE-2026-6229), the wpr_get_csv_handle() helper function falls back to using is_readable() and fopen() on the attacker-controlled settings.table_upload_csv.url parameter when the input does not parse as an HTTP URL. This fallback lacks allow-listing, directory traversal prevention, and file extension checks, allowing authenticated users with Contributor-level privileges or higher to save a crafted wpr-data-table widget via Elementor's save_builder endpoint. The rendered preview then discloses the contents of any file readable by the PHP process, including sensitive files such as wp-config.php.

An attacker with Contributor-level or higher access can read arbitrary files on the server that the PHP process can access. This can lead to disclosure of sensitive configuration files and potentially other sensitive data, compromising confidentiality. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the wpr-data-table widget. Avoid using affected plugin versions if possible.