PT-2026-23405 · WordPress · Royal Elementor Addons

Mcdruid · Published 2026-03-05 · Updated 2026-04-06 · CVE-2026-28135

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions WP Royal Royal Elementor Addons versions through 1.7.1049

Description The software contains a flaw related to the inclusion of functionality from an untrusted control sphere, potentially allowing access to functionality not properly constrained by access control lists (ACLs).

Recommendations Update WP Royal Royal Elementor Addons to a version later than 1.7.1049.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-28135

Affected Products

Royal Elementor Addons

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-28135 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1049-other-vulnerability-type-vulnerability?_s_id=cve · Note
• https://twitter.com/Swisswpsecure/status/2041153024530288755 · Twitter Post
• https://twitter.com/CVEnew/status/2029454827265359964 · Twitter Post