CVE-2026-17585: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
AI Analysis
Technical Summary
CVE-2026-17585 is a sensitive information exposure vulnerability (CWE-200) in the Royal Addons for Elementor plugin for WordPress, affecting all versions up to 1.7.1066. The flaw exists in the handling of the 'wpr_keyword' parameter, which enables unauthenticated attackers to extract arbitrary postmeta data from published posts through substring matching. The nonce required for this attack is publicly exposed via wp_localize_script on frontend pages with Royal Elementor widgets, allowing exploitation without authentication.
Potential Impact
An unauthenticated attacker can retrieve sensitive postmeta information from the WordPress database, potentially exposing confidential data stored in postmeta fields. This exposure does not affect integrity or availability but compromises confidentiality. The CVSS score is 5.3 (medium severity), reflecting the ease of exploitation and the limited scope of impact to information disclosure only.
Mitigation Recommendations
No patch or official fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, consider disabling the Royal Addons for Elementor plugin or restricting access to pages that load Royal Elementor widgets to trusted users only. Review and limit sensitive data stored in postmeta fields as a temporary measure.
CVE-2026-17585: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
Description
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
CVSS v3.1
Score 5.3medium
Affected software
wproyal
Royal Addons for Elementor – Addons and Templates Kit for Elementor
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17585 is a sensitive information exposure vulnerability (CWE-200) in the Royal Addons for Elementor plugin for WordPress, affecting all versions up to 1.7.1066. The flaw exists in the handling of the 'wpr_keyword' parameter, which enables unauthenticated attackers to extract arbitrary postmeta data from published posts through substring matching. The nonce required for this attack is publicly exposed via wp_localize_script on frontend pages with Royal Elementor widgets, allowing exploitation without authentication.
Potential Impact
An unauthenticated attacker can retrieve sensitive postmeta information from the WordPress database, potentially exposing confidential data stored in postmeta fields. This exposure does not affect integrity or availability but compromises confidentiality. The CVSS score is 5.3 (medium severity), reflecting the ease of exploitation and the limited scope of impact to information disclosure only.
Mitigation Recommendations
No patch or official fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, consider disabling the Royal Addons for Elementor plugin or restricting access to pages that load Royal Elementor widgets to trusted users only. Review and limit sensitive data stored in postmeta fields as a temporary measure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-27T15:57:56.711Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa5037555bf5e2cf506c910
Added to database: 09/12/2026, 07:47:01 UTC
Last enriched: 09/12/2026, 08:03:03 UTC
Last updated: 09/13/2026, 03:03:13 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.