PT-2026-127825

CVE-2026-107100

Published

2026-10-28

Updated

2026-10-28

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor versions 1.3.81 through 1.7.1069

Description An unauthenticated AJAX action fails to verify if a requested post is publicly viewable, relying solely on the published status rather than the post type's visibility. This allows unauthenticated users to disclose content from non-public post types, such as captured contact-form submissions containing names, email addresses, and messages.

Recommendations Update Royal Addons for Elementor to version 1.7.1070 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Maciek Komorowski

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers