The Royal Addons for Elementor plugin suffers from a missing authorization (CWE-862) on the `wpr_update_form_action_meta` AJAX action, which is registered for both authenticated and unauthenticated users. The nonce intended to protect this endpoint is publicly exposed in frontend JavaScript, negating its security benefit. The endpoint lacks capability or ownership checks and directly updates post meta with user-controlled input on a whitelisted set of keys. This allows unauthenticated attackers to modify form action metadata such as email and webhook configurations, potentially enabling tampering and data exfiltration.

An unauthenticated attacker can modify form action metadata on any post, including email, submission, Mailchimp, and webhook settings. This can lead to tampering with webhook or email actions and potentially result in data exfiltration via altered webhook URLs. There is no impact on confidentiality, but integrity is compromised. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published at this time. Until a patch is available, consider disabling the vulnerable plugin or restricting access to the affected AJAX action if possible.