The vulnerability CVE-2026-28135 affects the WP Royal Elementor Addons plugin, specifically versions up to and including 1.7.1052. It is characterized by the inclusion of functionality from an untrusted control sphere, which means that certain plugin features can be accessed without proper ACL enforcement. This lack of proper access control can allow unauthorized users to perform actions that may degrade or disrupt service availability. The CVSS v3.1 score is 8.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. There is no vendor advisory or patch information provided at this time.

The vulnerability allows unauthorized access to functionality within the WP Royal Elementor Addons plugin that should be restricted by ACLs. While confidentiality is not impacted, the integrity impact is limited, and the availability impact is high, meaning attackers could disrupt or degrade the availability of the affected system. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.