PT-2026-25870 · WordPress+2 · Royal Elementor Addons+3

Quốc Huy · Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-2373

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.1049

Description The Royal Addons for Elementor plugin for WordPress is susceptible to Information Exposure due to insufficient restrictions on post inclusion within the get main query args() function. This allows unauthenticated attackers to extract contents from non-public custom post types, including Contact Form 7 submissions and WooCommerce coupons.

Recommendations Update Royal Addons for Elementor – Addons and Templates Kit for Elementor to version 1.7.1049 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2373

Affected Products

Contact Form 7

Elementor

Royal Elementor Addons

Woocommerce

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2373 · Security Note
• https://t.me/cveNotify/155582 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3475656 · Note
• https://twitter.com/CVEarity/status/2033799470924894676 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=cve · Note