Read the docs
TI-2022-03751 Aliases CVE-2022-4103GHSA-p4g3-f45p-rr3m

Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation

Priority MEDIUM 53CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) (Unknown): 1.3.56

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownRoyal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets)before 1.3.561.3.56Patch availableCNA
  • Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) VendorUnknown Affected before 1.3.56 Fixed in 1.3.56 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:*before 1.3.56Vulnerablewproyal
  • cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:* Versions before 1.3.56 Vulnerable ·wproyal

Remediation

  • Fix · CNA Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) (Unknown) Fixed in 1.3.56

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) 1.3.56

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2022-03750 Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post DeletionPriority MEDIUM 48
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4103
  2. 2026-10-03 Alias added: GHSA-p4g3-f45p-rr3m

References

Exploit 1

  • TI-2023-04933 Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2023-05454 Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read CVSS 3.1HIGH 7.5
  • TI-2024-01463 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload CVSS 3.1CRITICAL 9.8
  • TI-2024-21660 WordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-03750 Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion CVSS 3.1LOW 3.1
  • TI-2022-04297 Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation CVSS 3.1HIGH 8.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences