CVE-2026-2373
Information Exposure in Royal Addons for Elementor Plugin Allows Data Leak
Publication date: 2026-03-17
Last updated on: 2026-03-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| royal_addons | royal_elementor_addons | to 1.7.1049 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Royal Addons for Elementor – Addons and Templates Kit for Elementor WordPress plugin, in all versions up to and including 1.7.1049. It is an Information Exposure issue caused by insufficient restrictions in the get_main_query_args() function. This flaw allows unauthenticated attackers to access and extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information stored in non-public custom post types within the WordPress site. For example, attackers could extract data from Contact Form 7 submissions, which may contain personal user information, or WooCommerce coupons, potentially leading to misuse or fraud. Since the vulnerability can be exploited without authentication, it poses a risk of data leakage and privacy breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the Royal Addons for Elementor plugin for WordPress, specifically versions up to and including 1.7.1049. Detection involves identifying if this vulnerable plugin version is installed on your WordPress site.
You can detect the presence of the vulnerable plugin version by checking the installed plugins and their versions on your WordPress installation.
- Use WP-CLI to list installed plugins and their versions: wp plugin list
- Check the plugin version directly in the WordPress admin dashboard under Plugins.
- Look for suspicious access patterns or requests attempting to exploit the get_main_query_args() function, which may appear as unauthorized attempts to access non-public custom post types.
No specific commands or network detection signatures are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the Royal Addons for Elementor plugin to a version later than 1.7.1049, as all versions up to and including 1.7.1049 are vulnerable.
Although the changeset for version 1.7.1050 does not explicitly mention security fixes related to this CVE, updating to the latest version is recommended to ensure you have the most recent patches and improvements.
- Backup your WordPress site and database before performing any updates.
- Update the plugin via the WordPress admin dashboard or using WP-CLI: wp plugin update royal-elementor-addons
- Restrict access to sensitive custom post types by implementing additional access controls or security plugins if immediate update is not possible.
Monitor your site logs for any suspicious activity related to unauthorized data access attempts.