CVE-2026-107100: Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content

Q: Which sites are realistically exposed to content disclosure?

Sites using a vulnerable version of the plugin are exposed if they have published posts in non-public post types. Examples include captured contact-form submissions that contain names, email addresses, and message content.

Q: Does exploitation require an authenticated WordPress account?

No. The affected AJAX action is unauthenticated, so an attacker does not need to log in to request the exposed content.

Q: What condition makes the vulnerable content retrievable?

The requested post must have published status. The vulnerable behavior does not verify whether the post type itself is publicly viewable.

Q: How can I determine whether sensitive information may already be exposed?

Review published entries in non-public post types, particularly any post types used to store form submissions or similar records. Content in those entries may be retrievable without authentication on affected plugin versions.

Published Oct 28, 2026

Updated

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.

Affected Software

1 affected component

WP Royal Royal Addons for Elementor>=1.3.81<=1.7.1069

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are realistically exposed to content disclosure?

Sites using a vulnerable version of the plugin are exposed if they have published posts in non-public post types. Examples include captured contact-form submissions that contain names, email addresses, and message content.

Does exploitation require an authenticated WordPress account?

No. The affected AJAX action is unauthenticated, so an attacker does not need to log in to request the exposed content.

What condition makes the vulnerable content retrievable?

The requested post must have published status. The vulnerable behavior does not verify whether the post type itself is publicly viewable.

How can I determine whether sensitive information may already be exposed?

Review published entries in non-public post types, particularly any post types used to store form submissions or similar records. Content in those entries may be retrievable without authentication on affected plugin versions.

CVE-2026-107100: Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content

Affected Software

Event History

Frequently Asked Questions

Which sites are realistically exposed to content disclosure?

Does exploitation require an authenticated WordPress account?

What condition makes the vulnerable content retrievable?

How can I determine whether sensitive information may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which sites are realistically exposed to content disclosure?

Does exploitation require an authenticated WordPress account?

What condition makes the vulnerable content retrievable?

How can I determine whether sensitive information may already be exposed?