CVE-2026-13402

Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure

Medium · published July 17, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.8th percentile
Published
2026-07-17T06:00Z
EPSS history
Timeline
  • 17 JUL 06:00Z
    Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure
    cvelistv5