CVE-2022-4702 in Royal Elementor Addons Plugin
Summary
by MITRE • 01/10/2023
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified in CVE-2022-4702 affects the Royal Elementor Addons plugin for WordPress, specifically targeting versions up to and including 1.3.59. This represents a critical access control flaw that undermines the security model of WordPress installations. The issue manifests through the 'wpr_fix_royal_compatibility' AJAX action which lacks proper authentication and authorization checks, creating a significant vector for privilege escalation and system disruption. The flaw exists within the plugin's core functionality and demonstrates poor security implementation practices that directly violate fundamental principles of secure software development.
The technical exploitation of this vulnerability occurs through an improperly secured AJAX endpoint that accepts requests without verifying user credentials or permissions. Any authenticated user, regardless of their role within the WordPress system, can trigger the malicious action that deactivates all plugins on the site. This includes users with the lowest privilege level of subscriber, which is particularly concerning as it bypasses normal WordPress permission hierarchies. The vulnerability specifically targets the plugin management system and theme switching functionality, allowing attackers to manipulate core site components without proper authorization. The hardcoded whitelist of protected plugins provides minimal defense and represents a flawed security-by-obscurity approach that can be easily bypassed.
The operational impact of this vulnerability extends beyond simple privilege escalation to create substantial availability and stability concerns for affected WordPress installations. When exploited, the vulnerability can deactivate all plugins on the site except those in the hardcoded whitelist, effectively rendering the website partially or completely non-functional depending on the importance of the deactivated plugins. Additionally, the automatic switching to the 'royal-elementor-kit' theme introduces further complications as it can break site functionality and user experience. This dual impact creates a scenario where attackers can simultaneously compromise both the plugin ecosystem and the visual presentation layer of the website, potentially causing widespread disruption for legitimate users and administrators.
From a cybersecurity perspective, this vulnerability aligns with CWE-284, which addresses inadequate access control mechanisms, and represents a clear violation of the principle of least privilege. The flaw also maps to several ATT&CK techniques including privilege escalation and defense evasion, as it allows attackers to manipulate system components while remaining undetected. Organizations should implement immediate mitigations including plugin updates to versions that address the access control issue, and consider additional security measures such as restricting AJAX endpoints through web application firewalls. The vulnerability demonstrates the importance of proper input validation and authentication checks in web applications, particularly those handling administrative functions. Security monitoring should be enhanced to detect unusual plugin deactivation patterns and theme switching activities that could indicate exploitation attempts.