CVE-2026-13404: CWE-639 Authorization Bypass Through User-Controlled Key in Royal Addons for Elementor

The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1066 do not enforce authorization checks when updating post meta data related to like counts and visitor tracking. Instead, the plugin relies solely on a nonce that can be publicly scraped, which is insufficient to prevent unauthorized access. This allows unauthenticated attackers to modify metadata on any post, including private and draft posts, by specifying arbitrary post IDs. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). No official patch or remediation level is currently documented.

An attacker without authentication can modify the like-count and visitor-tracking metadata of any post, including private and draft posts. This could lead to integrity issues in the affected site's content metadata, potentially misleading users or administrators about post popularity or visitor statistics. There is no indication of confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should monitor for updates from the plugin vendor and consider restricting access to the plugin's functionality or disabling it if possible to mitigate unauthorized metadata modifications.