Royal Addons EUVD-2026-111708

Exploitation requires that the target site runs Royal Addons for Elementor in the affected range (1.3.81 up to, but not including, 1.7.1070) and that sensitive data is stored in non-public post types that the plugin's unauthenticated AJAX action will return once a post is in published status. The disclosure is effective only when such non-public post types actually hold sensitive records - the cited example being captured contact-form submissions - so a site using the plugin without storing private data in non-public post types has little to leak. Limiting factors: the attacker must reference or enumerate the relevant post IDs, and the impact is confined to reading content (C:L) with no write or availability effect. No authentication or user interaction is required, consistent with PR:N/UI:N in the supplied CVSS vector.

This is a moderate-severity information-disclosure flaw (CVSS 5.3) whose signals are internally consistent and point to a real but non-urgent issue. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates remote, unauthenticated, low-complexity access with no user interaction and limited confidentiality impact only (no integrity or availability effect), matching the described behavior: an unauthenticated AJAX action returns post content without checking post-type visibility. EPSS is low at 0.16% (6th percentile), the vulnerability is NOT on CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', which aligns with the picture of a genuinely exploitable but low-impact disclosure rather than an emergency. The practical severity hinges on deployment: the C:L rating is appropriate because exploitation leaks only content from non-public post types (e.g., captured contact-form submissions with names, emails, and messages) rather than credentials or full database access. There are no conflicting signals here - low EPSS, no KEV, and limited impact all corroborate a 'patch on a normal cycle' priority rather than a drop-everything event.

An unauthenticated attacker sends crafted requests to the plugin's AJAX endpoint on a vulnerable WordPress site, referencing post IDs belonging to non-public post types. Because the plugin checks only the published status and not the post type's visibility, the endpoint returns the stored content, letting the attacker harvest private records such as contact-form submissions containing names, email addresses, and messages. No public exploit code was identified at time of analysis, but the attack requires no authentication, no user interaction, and only low complexity.