Vulnerability · Published Mar 17, 2026 · Assigned by Wordfence
CVE-2026-2373Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
Medium 5.3
In plain English
A medium-severity missing authorization in Royal Addons for Elementor – Addons and Templates Kit for Elementor from wproyal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wproyal | Royal Addons for Elementor – Addons and Templates Kit for Elementor | 0 – through 1.7.1049 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N