Royal Elementor Addons EUVD-2026-109717

The flaw is an Authorization Bypass Through User-Controlled Key (IDOR): exploitation requires sending a request to a Royal Elementor Addons endpoint while supplying an attacker-chosen identifier that references another user's or object's data, which the plugin returns because access control is incorrectly enforced. The specific vulnerable feature, endpoint, and parameter are not described in the available sources. Limiting factors: impact is confined to low confidentiality disclosure (I:N/A:N - no data modification or denial of service), and the affected scope is installations of Royal Elementor Addons at or below version 1.7.1069. The supplied vector indicates PR:N (no authentication), but because the trigger is not described, whether a logged-in session is actually required should be confirmed with the vendor before relying on fully unauthenticated exploitation.

This is a moderate-severity information-disclosure issue rather than a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity flaw with low confidentiality impact and no integrity or availability impact - consistent with an IDOR (CWE-639, Authorization Bypass Through User-Controlled Key) that lets a request read objects it should not. Exploitation status is 'no public exploit identified at time of analysis': the single reference is a Patchstack vulnerability-database entry, not verified working exploit code, and the CVE is not in CISA KEV. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. The vuln.today decision label is 'this_month', i.e. a scheduled-remediation priority, not act_now/emergency - aligning with the modest CVSS and absence of KEV/confirmed exploitation. One signal to verify: the CVSS vector states PR:N (unauthenticated), yet IDOR/broken-access-control flaws in WordPress plugins frequently require at least a low-privileged authenticated session; the available sources do not describe the exact trigger, so the no-authentication assumption should be confirmed with the vendor/Patchstack before treating it as fully unauthenticated.

A remote attacker sends crafted requests to the Royal Elementor Addons plugin, substituting an identifier (a user-controlled key such as a record or object ID) to reference data belonging to another user or tenant, and the plugin returns it because access control is not correctly enforced. Because impact is limited to confidentiality (C:L), the realistic outcome is unauthorized disclosure of limited data rather than modification or site takeover. No verified public exploit code exists; only a Patchstack advisory reference is available, and the precise vulnerable endpoint or parameter is not described in the sources.