EUVD-2026-76830
GHSA-637j-vv5r-2x85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth (nonce is public), no complexity; confidentiality impact limited to postmeta of published posts only.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The Royal Addons for Elementor - Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
AnalysisAI
Unauthenticated sensitive information exposure in the Royal Addons for Elementor WordPress plugin (all versions ≤1.7.1066) allows any remote attacker to enumerate arbitrary postmeta values from all published posts via a blind, character-by-character substring oracle. The critical enabler is that the AJAX nonce protecting the search endpoint is publicly emitted in page HTML via wp_localize_script whenever any Royal Elementor widget loads - no session, login, or prior action is required to obtain it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the target WordPress site has the Royal Addons for Elementor plugin installed and active, AND that at least one publicly accessible page renders any Royal Elementor widget (which causes the nonce to be emitted in the page HTML via wp_localize_script). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is technically consistent with the mechanics: network-reachable, no complexity, no credentials, no user interaction, and confidentiality impact scored low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - update Royal Addons for Elementor to the version above 1.7.1066 when released; the exact patched release version is not independently confirmed from the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in Royal Elementor Addons for WordPress (versions ≤1.7.1064) allows authenticated Contributo
Stored Cross-Site Scripting in Royal Elementor Addons WordPress plugin allows unauthenticated remote attackers to inject
Server-Side Request Forgery (SSRF) in Royal Elementor Addons plugin for WordPress allows authenticated attackers with Co
Arbitrary file read in Royal Addons for Elementor versions 1.7.1058-1.7.1059 allows authenticated attackers with Contrib
Stored Cross-Site Scripting in Royal Addons for Elementor's Instagram Feed widget allows authenticated contributors and
Stored Cross-Site Scripting in Royal Addons for Elementor plugin versions up to 1.7.1056 allows authenticated attackers
Stored cross-site scripting in Royal Elementor Addons plugin for WordPress up to version 1.7.1056 allows authenticated a
Stored Cross-Site Scripting (XSS) in Royal Addons for Elementor plugin allows authenticated contributors and above to in
Unauthenticated attackers can extract sensitive data from non-public custom post types in Royal Addons for Elementor Wor
Unauthenticated attackers can modify form action metadata on WordPress posts through the Royal Addons for Elementor plug
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today