CVE-2026-2373 is a missing authorization vulnerability in the Royal Addons for Elementor plugin for WordPress. The issue arises from insufficient access control in the get_main_query_args() function, which permits unauthenticated users to retrieve contents of non-public custom post types. This exposure includes sensitive data such as Contact Form 7 submissions and WooCommerce coupons. The vulnerability affects all versions up to and including 1.7.1049. The CVSS 3.1 base score is 5.3 (medium severity) with attack vector network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality only.

An unauthenticated attacker can extract sensitive information stored in non-public custom post types managed by the plugin, such as contact form submissions and coupon data. This leads to information disclosure but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should consider restricting access to affected custom post types through other WordPress access control mechanisms or disable the plugin if sensitive data exposure is a concern.