EUVD-2026-66266
GHSA-v5xw-4p3j-4gfh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Nonce is publicly scrapeable so PR:N and AC:L hold; impact is integrity-only on post meta with no confidentiality or availability consequence, yielding I:L/C:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.
AnalysisAI
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visitor to overwrite like-count and visitor-tracking post meta on arbitrary posts, including private and draft posts, because the plugin's AJAX handler validates only a nonce - a value scrapeable from any public page - without performing any WordPress capability or post-ownership check. A publicly available proof-of-concept exists per WPScan. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) scores 5.3 Medium, accurately reflecting network reachability with no prerequisites, but the scope change is absent and integrity impact is constrained to post meta rather than content or credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Royal Addons for Elementor to version 1.7.1066 or later via the WordPress plugin dashboard or wp-cli ('wp plugin update royal-elementor-addons'). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Royal Addons For Elementor
View allStored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows aut
Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits an
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes
Royal Addons for Elementor WordPress plugin before 1.7.1063 exposes private and draft Elementor template content to unau
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today