Description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Royal Addons for Elementor | < 1.7.1066 | 1.7.1066 |
Advisories 1
- WID-SEC-2026-3012 WP Royal Royal Elementor Addons: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Aug 25, 2026
References
- https://wpscan.com/vulnerability/44b457b8-5759-4d1d-b6fd-9dfe19a249a6/ exploit vdb-entry technical-description