Read the docs
TI-2026-11352 Aliases CVE-2026-13404GHSA-v5xw-4p3j-4gfh

Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

Priority LOW 30CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-639.

Summary

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Royal Addons for Elementor (Unknown): 1.7.1066

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownRoyal Addons for Elementorbefore 1.7.10661.7.1066Patch availableCNA
  • Royal Addons for Elementor VendorUnknown Affected before 1.7.1066 Fixed in 1.7.1066 Patch available CNA

Remediation

  • Fix · CNA Royal Addons for Elementor (Unknown) Fixed in 1.7.1066

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Royal Addons for Elementor 1.7.1066

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-15698 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect SettingsPriority LOW 32
    • TI-2026-11354 Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term DisclosurePriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13404
  2. 2026-10-03 Alias added: GHSA-v5xw-4p3j-4gfh

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences