CVE-2026-17585: Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wprkeyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wppostmeta table. The required nonce is emitted publicly via wplocalizescript on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. The nonce needed by the affected AJAX functionality is publicly emitted on frontend pages that load a Royal Elementor widget, so no login or prior interaction is required.
What information can an attacker obtain?
An attacker can extract arbitrary postmeta values associated with published posts. Extraction is performed character by character through substring matching against the wp_postmeta table.
Are sites affected by default?
A site is exposed when it runs an affected version and has a frontend page that loads a Royal Elementor widget, because that page exposes the required nonce.
How can I determine whether my site is affected?
Check the installed Royal Addons for Elementor version. Versions through 1.7.1066 are affected; also verify whether frontend pages load a Royal Elementor widget, which makes the required nonce publicly available.