What is the CVSS score of CVE-2026-28135?

CVE-2026-28135 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of WP Royal Royal Elementor Addons are affected by CVE-2026-28135?

A high-severity vulnerability in the Royal Elementor Addons WordPress plugin (CVE-2026-28135) allows attackers to execute untrusted code, potentially compromising websites using this plugin.

How to fix or mitigate CVE-2026-28135?

Within 24 hours: Identify all WordPress installations using Royal Elementor Addons plugin and document affected systems; disable the plugin on all non-critical environments immediately. Within 7 days: Implement WAF rules to block suspicious requests to the plugin; isolate affected production systems from sensitive data networks if disabling is not possible; audit logs for signs of exploitation. Within 30 days: Develop a complete remediation plan—either replace the plugin with a secure alternative, remove affected functionality, or apply vendor patch if released; conduct security testing before re-enabling any modified version.

WP Royal Royal Elementor Addons CVE-2026-28135

HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-03-05 audit@patchstack.com

Information Disclosure

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.2

DescriptionCVE.org

Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1049.

AnalysisAI

WP Royal Royal Elementor Addons royal-elementor-addons is affected by inclusion of functionality from untrusted control sphere (CVSS 8.2).

Technical ContextAI

This vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) affects WP Royal Royal Elementor Addons royal-elementor-addons. Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1049.