Unsafe Reflection Enables Code Injection in Elementor Addons

CVE-2026-111851 represents a critical code injection vulnerability stemming from unsafe reflection in Royal Elementor Addons versions up to 1.7.1068. The flaw allows attackers to exploit externally-controlled input to dynamically select and instantiate arbitrary classes or code, bypassing security controls and enabling remote code execution on affected WordPress installations. This vulnerability affects any organization using the Royal Elementor Addons plugin, particularly those building custom page layouts through Elementor, potentially impacting thousands of websites that rely on this popular WordPress extension.

While this specific CVE lacks direct MITRE ATT&CK technique mappings, Casky's AI-driven security skill analysis would detect the underlying attack patterns associated with code injection and unsafe deserialization workflows. Practitioners using Casky would observe findings related to input validation failures, dynamic code execution mechanisms, and class instantiation exploits—patterns typically connected to Execution techniques (T1059) and potentially Defense Evasion tactics (T1027). Although no specific Casky skills currently map to this vulnerability's CWE-470 classification, the platform's extended reasoning capability would help security teams recognize similar unsafe reflection patterns across their codebase and third-party dependencies, enabling proactive identification of comparable injection vectors before exploitation occurs.