Access Control Vulnerability in Royal Elementor Addons by WP Royal
CVE-2026-28135

8.2HIGH

Key Information:

Vendor

WordPress
Status
Royal Elementor Addons
Vendor
CVE Published:
5 March 2026

What is CVE-2026-28135?

The Royal Elementor Addons plugin for WordPress contains a security flaw that allows unauthorized access to functionalities that are not properly constrained by Access Control Lists (ACLs). This vulnerability affects versions up to and including 1.7.1049 of the plugin, potentially exposing sensitive operations to malicious actors. It is crucial for users to update their plugin to mitigate the risk associated with this vulnerability.

Affected Version(s)

Royal Elementor Addons 0 <= 1.7.1052

References

https://patchstack.com/database/Wordpress/Plugin/royal-el...
vdb-entry

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mcdruid | Patchstack Bug Bounty Program
.