CVE-2026-17585 in Royal Addons for Elementor Plugin
Summary
by MITRE • 09/12/2026
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in the Royal Addons for Elementor plugin affects all versions up to and including 1.7.1066, representing a critical failure in input validation and access control mechanisms within the WordPress ecosystem. This flaw allows unauthenticated attackers to perform sensitive information exposure attacks against any website utilizing this specific plugin. The core of the issue lies in how the plugin handles data retrieval requests through its AJAX endpoints or script handlers, specifically when processing the wpr_keyword parameter. Instead of restricting access based on user roles or validating the integrity of the request beyond a basic nonce check, the application logic permits arbitrary queries against the database backend without sufficient sanitization or authorization checks.
The technical mechanism exploited by this vulnerability relies heavily on the improper handling of nonces and the lack of strict input filtering. Typically, WordPress plugins use Nonce (Number used once) tokens to prevent Cross-Site Request Forgery attacks by ensuring that a request originated from a legitimate source within the application context. However, in this specific implementation, the required nonce is emitted publicly via wp_localize_script on any frontend page where a Royal Elementor widget is loaded. This design choice effectively neutralizes the protective value of the nonce for unauthenticated users, as anyone visiting the site can extract the token from the source code or network traffic without needing to log in or perform any prior authenticated actions. Consequently, an attacker does not need valid credentials to interact with the vulnerable endpoint.
Once the nonce is obtained, the exploitation process involves character-by-character substring matching against the wp_postmeta table. The wpr_keyword parameter acts as a vector for blind SQL injection-like behavior or inefficient query construction that allows the attacker to infer data bit by bit. By manipulating this parameter and observing differences in response times or error states, an adversary can systematically extract arbitrary post meta values stored in the WordPress database. This technique bypasses standard search functionalities because it does not rely on full-string matches but rather constructs queries that reveal information about specific metadata fields associated with published posts. The wp_postmeta table is particularly sensitive as it stores a vast array of configuration data, custom field values, and potentially secret keys or API tokens used by the site owner.
The operational impact of this vulnerability is severe due to the breadth of data accessible through the compromised endpoint. Attackers can extract arbitrary post meta values from all published posts on the target WordPress installation. This includes sensitive information such as security keys, authentication cookies, third-party service credentials, and other configuration details that are not intended for public consumption. The ability to enumerate this data without authentication significantly lowers the barrier for entry, allowing even low-skilled threat actors to compromise site integrity. Furthermore, because the vulnerability exists in a widely used plugin ecosystem involving Elementor page builders, the potential attack surface is extensive across thousands of websites globally.
From an industry standards perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-798: Use of Hard-coded Credentials if sensitive data like API keys are stored in post meta. It also relates to CWE-613: Insufficient Session Expiration if the nonce reuse is considered a session management failure, although the primary issue is the public emission of authentication tokens. In terms of MITRE ATT&CK framework, this behavior maps to T1005: Data from Local System and potentially T1190: Exploit Public-Facing Application, as it involves extracting data from an application accessible over a network without prior access. The lack of proper authorization checks for sensitive operations is a classic example of broken access control principles found in CWE-862.
Mitigation strategies must focus on immediate remediation and long-term security hardening. Site administrators should update the Royal Addons for Elementor plugin to version 1.7.1067 or later, where this vulnerability has been patched by restricting nonce validation and improving input sanitization. If updating is not immediately possible, temporary mitigations include disabling any widgets that trigger the vulnerable endpoint via server-side configuration rules such as ModSecurity WAF rules blocking requests containing specific patterns in the wpr_keyword parameter. Additionally, implementing strict rate limiting on AJAX endpoints can help mitigate brute-force style extraction attempts. Developers should ensure that nonces are generated per-session or with short lifespans and never exposed to unauthenticated contexts unless strictly necessary for public-facing functionality that does not involve sensitive data retrieval. Regular security audits of custom plugins and third-party extensions are essential to prevent similar exposures in the future, ensuring that all database interactions adhere to the principle of least privilege and proper input validation standards.