EUVD-2026-26763Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpr_update_form_action_meta AJAX action in all versions up to, and including, 1.7.1056. The handler is registered on both wp_ajax and wp_ajax_nopriv hooks, making it accessible to unauthenticated users. Although a nonce is verified, the nonce (wpr-addons-js) is publicly exposed in frontend JavaScript via WprConfig.nonce on any page that loads Royal Addons widgets, rendering the protection ineffective. The endpoint also lacks any capability or ownership checks and directly calls update_post_meta() with user-controlled input on a whitelisted set of form action meta keys. This makes it possible for unauthenticated attackers to modify form action configuration metadata (email, submissions, Mailchimp, and webhook settings) on any post, potentially leading to webhook/email action tampering and data exfiltration via modified webhook URLs.
AnalysisAI
Unauthenticated attackers can modify form action metadata on WordPress posts through the Royal Addons for Elementor plugin (versions up to 1.7.1056) due to a missing capability check on the wpr_update_form_action_meta AJAX endpoint. The endpoint registers on both wp_ajax and wp_ajax_nopriv hooks, is accessible without authentication, and relies on a nonce that is publicly exposed in frontend JavaScript, allowing attackers to bypass the nonce protection and alter email, Mailchimp, and webhook settings on any post. This enables attackers to hijack form submissions, exfiltrate data via modified webhook URLs, or redirect emails to attacker-controlled addresses without any user interaction or special configuration required.
Technical ContextAI
Royal Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets and functionality. The vulnerability exists in the form actions module, specifically in the wpr_update_form_action_meta AJAX handler. AJAX handlers registered on the wp_ajax_nopriv hook in WordPress are intended for non-privileged (unauthenticated) users, but this handler should have been registered only on wp_ajax. The handler uses update_post_meta() to modify form configuration data; however, it lacks the typical WordPress security checks-neither a user capability check (e.g., current_user_can()) nor post ownership verification. The nonce check, while present, is rendered ineffective because the nonce value (wpr-addons-js) is injected directly into frontend JavaScript via WprConfig.nonce on every page that loads Royal Addons widgets, making it available to all visitors including unauthenticated attackers. The CWE-862 classification (Missing Authorization) indicates that the root cause is the absence of proper privilege or capability validation before performing sensitive operations on post metadata.
RemediationAI
Upgrade Royal Addons for Elementor to a version newer than 1.7.1056 immediately; check the WordPress plugin repository or vendor site for the latest patched release. The vendor should have released a fix that moves the wpr_update_form_action_meta handler to the wp_ajax hook only (removing wp_ajax_nopriv), adds proper capability checks using current_user_can() to verify the user has edit_post capability for the target post, and implements post ownership validation before allowing metadata updates. While awaiting a patch, apply these compensating controls: (1) Disable Royal Addons plugin entirely if not actively required-this eliminates the attack surface entirely but prevents use of plugin features; (2) Restrict AJAX endpoints via WordPress configuration or WAF rules by blocking POST requests to wp-admin/admin-ajax.php for the action parameter wpr_update_form_action_meta from unauthenticated users, though this requires careful rule crafting to avoid blocking legitimate admins; (3) Implement network-level access controls restricting wp-admin directory access to trusted IP ranges, which mitigates but does not eliminate the risk since the vulnerable endpoint is exposed to frontend users. Verify via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2ecec7d7-d1b2-4ccf-ade6-1f78224968c6) for the exact patched version number once available.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today