CVE Database /
CVE-2026-4024
CVE · Medium
CVE-2026-4024 — Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-4024
|
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons] < 1.7.1057 |
Missing Authorization |
Medium
5.3
|
< 1.7.1057
|
1.7.1057 |
2026-05-01 |
—
|
CVE-2026-4024
The Royal Addons for Elementor plugin's AJAX handling mechanism is flawed in versions prior to 1.7.1056. Specifically, the `wpr_update_form_action_meta` action can be triggered by anyone due to a lack of capability checks on both authenticated and unauthenticated user requests. This vulnerability stems from an exposed nonce that is verified but easily accessible through frontend JavaScript code, rendering its protective value negligible.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings