CVE-2026-13404
Received Received - Intake

Unauthenticated Post Meta Modification in Royal Addons for Elementor

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: WPScan

Description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-13404
EUVD
EUVD-2026-66266

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
royal_addons elementor to 1.7.1066 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Royal Addons for Elementor WordPress plugin before version 1.7.1066. It allows unauthenticated users to modify like-count and visitor-tracking metadata on any post, including private or draft posts, by exploiting a publicly accessible nonce without proper permission checks.

Detection Guidance

Check if the Royal Addons for Elementor plugin version is below 1.7.1066. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Look for unauthorized changes in post meta data such as like counts or visitor tracking.

Impact Analysis

An attacker could manipulate post metadata like like counts or visitor tracking, potentially altering post visibility or analytics. Since private and draft posts are affected, sensitive content exposure or metadata corruption is possible.

Compliance Impact

This vulnerability could lead to unauthorized modifications of post metadata, potentially violating data integrity principles under GDPR and HIPAA. Exposure of private or draft post data may also conflict with confidentiality requirements.

Mitigation Strategies

Update the Royal Addons for Elementor plugin to version 1.7.1066 or later immediately. Remove or disable the plugin if an update is not available. Review post meta data for unauthorized changes and restrict access to sensitive posts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart