What is the CVSS score of CVE-2026-25436?

CVE-2026-25436 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-25436?

Yes, a patch is available for CVE-2026-25436. Update the affected software to the latest version immediately.

Royal Elementor Addons CVE-2026-25436

EUVD-2026-28330 MEDIUM

Missing Authorization (CWE-862)

2026-05-07 Patchstack

GHSA-mqxj-f3xw-28v4

WordPress Authentication Bypass Royal Elementor Addons Wordpress Plugin Elementor Wproyal

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 07, 2026 - 10:16 EUVD

Analysis Generated

May 07, 2026 - 09:00 vuln.today

CVE Published

May 07, 2026 - 07:34 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Royal Elementor Addons: from n/a before 1.7.1053.

AnalysisAI

Missing authorization in Royal Elementor Addons before version 1.7.1053 allows unauthenticated remote attackers to read sensitive information via incorrectly configured access control security levels. The vulnerability affects the WordPress plugin and exposes confidential data without requiring user authentication or interaction, impacting all installations below the patched version.

Technical ContextAI

Royal Elementor Addons is a WordPress plugin that extends the Elementor page builder with additional UI components and functionality. The vulnerability stems from improper implementation of authorization checks (CWE-862: Missing Authorization), where access control decisions are not properly enforced on sensitive operations or data retrieval endpoints. This allows an attacker to bypass authentication mechanisms and directly access protected resources that should require proper user privileges. The plugin runs within WordPress's authentication and capability framework; the flaw indicates the plugin either fails to call WordPress authorization functions (wp_verify_nonce, current_user_can) or implements custom authorization logic incorrectly, allowing unauthorized API calls or direct parameter manipulation to retrieve restricted content.

RemediationAI

Immediately upgrade Royal Elementor Addons to version 1.7.1053 or later, which includes the authorization control fixes. WordPress administrators should log in to the plugin dashboard, navigate to Plugins → Installed Plugins, and update Royal Elementor Addons to the patched version. There are no documented workarounds; the vulnerability cannot be mitigated through configuration changes since it is a code-level authorization flaw. Until patching is possible, consider temporarily deactivating the plugin if it is not critical to site functionality, though this approach impacts site features provided by the addon. Site owners using multisite WordPress installations should ensure all sites have the patch applied, as the vulnerability affects each installation independently. Refer to the Patchstack advisory for confirmation of patch deployment success.