PT-2026-25870 · WordPress+2 · Royal Elementor Addons+3

Quốc Huy · Publicado 2026-03-17 · Atualizado 2026-03-17 · CVE-2026-2373

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.1049

Description The Royal Addons for Elementor plugin for WordPress is susceptible to Information Exposure due to insufficient restrictions on post inclusion within the get main query args() function. This allows unauthenticated attackers to extract contents from non-public custom post types, including Contact Form 7 submissions and WooCommerce coupons.

Recommendations Update Royal Addons for Elementor – Addons and Templates Kit for Elementor to version 1.7.1049 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2373

Produtos afetados

Contact Form 7

Elementor

Royal Elementor Addons

Woocommerce

Referências · 5

• https://t.me/cveNotify/155582 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2373 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3475656 · Nota
• https://twitter.com/CVEarity/status/2033799470924894676 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=cve · Nota