CVE-2026-13406: Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They need only be able to submit a request that supplies the target taxonomy.

Q: What information can be exposed?

The issue can disclose the names and IDs of terms in non-public taxonomies. The provided data does not indicate that term content, posts, or user accounts are exposed.

Q: Which installations are affected?

Installations using Royal Elementor Addons versions before 1.7.1066 are affected. The issue is caused by missing capability and nonce checks on the taxonomy-term data response.

Published Aug 26, 2026

Updated

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.

Affected Software

1 affected component

WordPress plugin "Royal Elementor Addons"<1.7.1066

Event History

Aug 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They need only be able to submit a request that supplies the target taxonomy.

What information can be exposed?

The issue can disclose the names and IDs of terms in non-public taxonomies. The provided data does not indicate that term content, posts, or user accounts are exposed.

Which installations are affected?

Installations using Royal Elementor Addons versions before 1.7.1066 are affected. The issue is caused by missing capability and nonce checks on the taxonomy-term data response.