PT-2026-25870 · Wproyal · Royal Addons For Elementor – Addons/Templates Kit For Elementor

Quốc Huy · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-2373

NVD

CVSS v3.1

5.3

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get main query args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2373

Affected Products

Royal Addons For Elementor – Addons/Templates Kit For Elementor

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-2373 · Security Note
• https://plugins.trac.wordpress.org/changeset/3475656 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=cve · Note