medium5.3
CVE-2026-13404
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce…
Impact
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.
Affected products
| Product | Affected versions |
|---|---|
| Royal Addons For Elementor WordPress Plugin | before 1.7.1066 |
Versions were read from the advisory text. No structured product data has been published for this record yet.