CVE-2026-17585

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.107

Description The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress allows unauthenticated attackers to extract arbitrary postmeta values from all published posts. This is achieved through character-by-character substring matching across the entire wp postmeta table using the wpr keyword parameter. The required nonce is publicly available via wp localize script on any frontend page that loads a Royal Elementor widget, removing the need for an authenticated session.

Recommendations Update the plugin to a version later than 1.7.1066. As a temporary mitigation, restrict access to or avoid using the wpr keyword parameter.