CVE-2026-13402: CWE-200 Information Exposure in Royal Addons for Elementor
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
AI Analysis
Technical Summary
The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1063 contain a vulnerability where a REST endpoint does not properly check the post status of menu items or their referenced templates. This flaw permits unauthenticated attackers to retrieve rendered HTML content of private or draft Elementor templates that are linked from non-public navigation menu items, leading to unintended information disclosure (CWE-200).
Potential Impact
Unauthenticated users can access the rendered HTML content of private or draft Elementor templates that should not be publicly accessible. This exposure can lead to leakage of sensitive or confidential information contained within these templates.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST endpoint if possible or monitor for updates from the plugin vendor. No official patch or workaround is currently documented.
CVE-2026-13402: CWE-200 Information Exposure in Royal Addons for Elementor
Description
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1063 contain a vulnerability where a REST endpoint does not properly check the post status of menu items or their referenced templates. This flaw permits unauthenticated attackers to retrieve rendered HTML content of private or draft Elementor templates that are linked from non-public navigation menu items, leading to unintended information disclosure (CWE-200).
Potential Impact
Unauthenticated users can access the rendered HTML content of private or draft Elementor templates that should not be publicly accessible. This exposure can lead to leakage of sensitive or confidential information contained within these templates.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST endpoint if possible or monitor for updates from the plugin vendor. No official patch or workaround is currently documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-26T08:45:52.657Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59dfe668715ace439a8d14
Added to database: 07/17/2026, 07:55:18 UTC
Last enriched: 07/17/2026, 07:56:04 UTC
Last updated: 08/26/2026, 22:52:08 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.