Unauthenticated Template Content Exposure in Royal Addons for Elementor

Executive Summary

This vulnerability in the Royal Addons for Elementor WordPress plugin before version 1.7.1063 allows unauthenticated users to access private or draft Elementor templates linked to non-public navigation menu items. It occurs because a REST endpoint does not check the post status of menu items or templates, enabling disclosure of sensitive HTML content.

Useful 0 Not Useful 0

Detection Guidance

Check if the Royal Addons for Elementor plugin version is below 1.7.1063. Use WordPress commands like 'wp plugin list' or inspect the plugin files for version details. Test the vulnerable REST endpoint by sending a request to '/wp-json/royal-elementor/v1/get_template_html' with a menu item ID parameter to see if it returns private template content.

• Use curl to test the endpoint: curl -X POST 'https://example.com/wp-json/royal-elementor/v1/get_template_html?menu_item_id=123' where 123 is a menu item ID.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to retrieve restricted content such as draft pages or private templates, potentially exposing sensitive information. This could lead to data leaks or unauthorized access to unpublished content on a WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR or HIPAA if personal or protected health information is exposed. Organizations must ensure proper access controls to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Royal Addons for Elementor plugin to version 1.7.1063 or later immediately. If an update is not available, consider disabling the plugin temporarily until a patch is released. Review and restrict access to sensitive templates and menu items.

Useful 0 Not Useful 0