Description

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:24.700Z",
  "pubdate": "2026-08-26T06:16:24.700Z",
  "executiveSummary": "The Royal Addons for Elementor plugin is susceptible to an unauthenticated Information Disclosure vulnerability. This flaw stems from a lack of proper access control mechanisms—specifically the absence of capability and nonce verification—within the plugin's taxonomy data retrieval functionality. By interacting with the affected endpoint, an unauthenticated remote attacker can query and retrieve information regarding private or non-public WordPress taxonomy terms, including their names and IDs. This vulnerability exposes sensitive site structure data that is intended to be hidden from unauthorized users. The risk is significant as it facilitates unauthorized reconnaissance, allowing attackers to map internal taxonomy structures, identify hidden content categories, and potentially uncover sensitive information that may assist in further targeted attacks against the WordPress installation. No special privileges are required to exploit this issue, and the attack can be executed over the network by any unauthenticated visitor.",
  "technicalDetails": "The vulnerability resides in the internal processing logic of the Royal Addons for Elementor plugin, which fails to implement mandatory security checks for API requests related to taxonomy term retrieval. In the affected versions prior to 1.7.1066, the plugin provides an endpoint that accepts user-supplied taxonomy identifiers to return corresponding term data. The root cause of this security defect is the omission of both capability checks (using current_user_can) and cryptographic nonce validation (using wp_verify_nonce) within the request handling sequence.\nUnder standard WordPress security practices, functions that return data derived from the database, particularly those involving sensitive or restricted taxonomies, must verify the request's origin and the user's authorization level. Because these checks are absent, the application executes the data retrieval logic regardless of the caller's authentication status or privileges. An attacker can craft a malicious HTTP request that specifies a target taxonomy slug via a GET or POST parameter. The server-side code then proceeds to query the wp_terms and wp_term_taxonomy tables for the specified taxonomy and returns the results directly to the client.\nThe attack flow follows a straightforward pattern: 1) The attacker identifies the plugin's endpoint responsible for term lookups. 2) The attacker sends an unauthenticated request to this endpoint, passing the slug of a non-public or private taxonomy as an input argument. 3) The plugin fails to validate the request, processes the input, and retrieves the internal taxonomy data from the WordPress database. 4) The plugin serializes this data into a JSON response, effectively leaking term IDs and names to the attacker. By iterating through possible taxonomy names or guessing internal identifiers, an attacker can enumerate the full structure of restricted taxonomies. This level of information disclosure provides an attacker with deep insights into the site's content architecture, potentially revealing the existence of draft pages, private membership structures, or other sensitive categories that the administrator intended to keep shielded from the public."
}