CVE-2026-4024 — The Royal Addons for Elementor plugin for WordPress is

title: WordPress Royal Addons - Unauthorized Form Action Modification - CVE-2026-4024
id: scw-2026-05-02-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to exploit CVE-2026-4024 by targeting the `wpr_update_form_action_meta` AJAX action in the Royal Addons for Elementor plugin. Unauthenticated attackers can leverage this vulnerability to modify form action metadata, such as email, submission, Mailchimp, and webhook settings, potentially leading to data exfiltration or manipulation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-4024/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=wpr_update_form_action_meta'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse