Vulnerability · Published Jul 17, 2026 · Assigned by WPScan

CVE-2026-13402Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure

Medium 5.3

In plain English

A medium-severity information exposure in Royal Addons for Elementor from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Royal Addons for Elementor	0 – before 1.7.1063

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/1a7a9159-0e85-43c4-b1ab-7ea37a4f2d95/ exploit, vdb-entry, technical-description