CVE-2026-13405
Received Received - Intake

Arbitrary PHP Code Execution in Royal Addons for Elementor

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: WPScan

Description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-13405
EUVD
EUVD-2026-63201

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
royal_addons royal_elementor_addons to 1.7.1066 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Royal Addons for Elementor WordPress plugin before version 1.7.1066 has a flaw where custom widget markup is not properly sanitized before being written to a file. This allows users with the manage_options capability, including non-super subsite administrators on WordPress Multisite, to execute arbitrary PHP code by injecting malicious markup.

Detection Guidance

Check the installed version of the Royal Addons for Elementor plugin. If it is below 1.7.1066, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

This vulnerability allows attackers with specific WordPress capabilities to execute arbitrary PHP code on your site. This could lead to complete site compromise, data theft, or further attacks. Non-super subsite administrators on WordPress Multisite are also affected.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Such breaches could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Royal Addons for Elementor plugin to version 1.7.1066 or later immediately. Remove or disable the plugin if updating is not possible. Restrict access to the manage_options capability for non-trusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13405. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart