Description

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T08:16:23.950Z",
  "pubdate": "2026-09-12T08:16:23.950Z",
  "executiveSummary": "Royal Addons for Elementor – Addons and Templates Kit for Elementor is affected by a critical Sensitive Information Exposure vulnerability in versions up to and including 1.7.1066.\nThe vulnerability allows unauthenticated remote attackers to perform side-channel extraction of sensitive data stored within the wp_postmeta table.\nBy leveraging a publicly exposed nonce and the 'wpr_keyword' parameter, an attacker can conduct character-by-character substring matching to exfiltrate arbitrary meta values.\nThis vulnerability does not require prior authentication or elevated privileges, as the necessary nonce is disclosed via wp_localize_script on any frontend page containing a Royal Elementor widget.\nSuccessful exploitation leads to the unauthorized disclosure of potentially sensitive information, including private configuration data, security tokens, or user-related metadata stored in the WordPress database.\nThe risk is high, as the exploitability is trivial due to the public accessibility of the required nonce and the predictable nature of the parameter-based attack vector.",
  "technicalDetails": "The vulnerability originates from improper input handling within the 'wpr_keyword' parameter used by Royal Addons for Elementor. The application logic fails to adequately validate or sanitize the input provided to this parameter, which is subsequently used in database queries involving the wp_postmeta table.\nThe attack vector relies on a side-channel technique where an attacker performs blind SQL injection-like operations using substring matching. By systematically iterating through potential character values and observing the application response—often reflected in the output of the widget—the attacker can reconstruct arbitrary strings stored in the postmeta database entries.\nThe core requirement for this interaction is a nonce, which is typically used for security validation. In this plugin, the nonce is emitted into the HTML source code of the frontend via the wp_localize_script function. This function ensures the nonce is available to the client-side JavaScript of any page utilizing a Royal Elementor widget, effectively neutralizing the intended security purpose of the nonce.\nThe attack flow follows these steps: First, the attacker visits any publicly accessible page where a Royal Addons widget is active to harvest the nonce from the page source. Second, the attacker crafts a series of HTTP requests directed at the vulnerable component, passing the harvested nonce in the request. Third, the attacker manipulates the 'wpr_keyword' parameter with specifically crafted payloads designed to test for specific characters in target postmeta entries. Fourth, by analyzing the variations in the application response, the attacker verifies the success of each character guess, building the exfiltrated string piece by piece.\nThis vulnerability is present in all versions up to and including 1.7.1066. Because the exploit occurs at the network layer and does not require active session management or administrative permissions, it presents a significant exposure for any WordPress installation utilizing the affected versions of Royal Addons.\nThe post-exploitation impact is severe, as the wp_postmeta table often contains critical data. Attackers can potentially exfiltrate sensitive keys, serialized objects, or user metadata that was not intended for public access, leading to further system compromise or data breaches."
}