Unauthorized Data Modification in Royal Addons for Elementor Plugin by WP

CVE-2026-4024

What is CVE-2026-4024?

The Royal Addons for Elementor plugin for WordPress is susceptible to unauthorized data modification due to inadequate capability checks on the wpr_update_form_action_meta AJAX action. This vulnerability exists in all versions up to and including 1.7.1056. The AJAX handler, accessible to unauthenticated users via both wp_ajax and wp_ajax_nopriv hooks, does not enforce proper checks, enabling attackers to exploit it. While a nonce is present, it is exposed in the frontend JavaScript, bypassing its intended security. Attackers can manipulate form action metadata for email configurations, submissions, and webhook settings on any post. This could lead to potential data breaches and manipulation of webhook/email actions.

References