Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons… (CVE-2026-111851)

CVE-2026-111851 is a vulnerability in WProyal Royal Elementor Addons (up to version 1.7.1068) where externally-controlled input is used unsafely to select classes or code, a condition known as unsafe reflection (CWE-470). This flaw can lead to code injection, allowing an attacker with low privileges to execute arbitrary code, potentially disrupting service availability and affecting confidentiality and integrity to a lesser extent. The CVSS v3.1 score is 7.6, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

The vulnerability allows an attacker to inject code remotely with low privileges and no user interaction, potentially leading to service disruption (high availability impact) and limited confidentiality and integrity compromise.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, review and restrict access to the affected plugin and monitor for suspicious activity related to code injection attempts.