CVE-2026-13404: Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Royal Addons for Elementor versions earlier than 1.7.1066 are exposed. The affected functionality can write metadata for arbitrary post IDs, including private and draft posts.
Does an attacker need an account or special permissions?
No. Exploitation is unauthenticated because the plugin does not enforce capability or ownership checks. The only stated protection is a nonce that can be publicly scraped.
What can an attacker change?
An attacker can modify like-count and visitor-tracking IP metadata associated with an arbitrary post ID. This can affect any post, including non-public private and draft posts.