CVE-2026-97255: WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WProyal Royal Elementor Addons (royal-elementor-addons)to a version that resolves this vulnerability.Fixed in 1.7.1070
Event History
Frequently Asked Questions
Which installations are affected?
Royal Elementor Addons versions through 1.7.1069 are affected. The available data does not identify a lower affected version boundary.
Does exploitation require authentication or user interaction?
No. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the likely security impact?
The CVSS vector indicates low confidentiality impact and no integrity or availability impact. The issue is described as an authorization bypass through a user-controlled key and incorrectly configured access control.