Access Control Vulnerability in Royal Elementor Addons by WP Royal
CVE-2026-40763

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Royal Elementor Addons
Vendor
CVE Published:
15 April 2026

What is CVE-2026-40763?

A missing authorization vulnerability exists in the Royal Elementor Addons plugin for WordPress, specifically affecting versions up to 1.7.1056. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. As a result, attackers may gain unauthorized access to sensitive areas of a website, potentially leading to security breaches. To ensure the safety of your WordPress site, it is essential to update the plugin to the latest version that addresses this vulnerability.

Affected Version(s)

Royal Elementor Addons 0 <= 1.7.1056

References

https://patchstack.com/database/Wordpress/Plugin/royal-el...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bao - BlueRock | Patchstack Bug Bounty Program
.