CVE-2026-13402 Overview
CVE-2026-13402 is an information disclosure vulnerability in the Royal Addons for Elementor WordPress plugin before version 1.7.1063. The plugin exposes a REST endpoint that fails to validate the post status of menu items or the templates they reference. Unauthenticated attackers can query this endpoint to retrieve the rendered HTML of private or draft Elementor templates linked from non-public navigation menu items. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can retrieve draft and private Elementor template content, exposing unpublished pages and internal design assets.
Affected Products
- Royal Addons for Elementor WordPress plugin versions prior to 1.7.1063
- WordPress sites using Elementor with non-public navigation menu items
- Any site referencing private or draft templates through the plugin's menu integration
Discovery Timeline
- 2026-07-17 - CVE-2026-13402 published to the National Vulnerability Database
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-13402
Vulnerability Analysis
The Royal Addons for Elementor plugin exposes a REST API endpoint that renders Elementor templates referenced by WordPress navigation menu items. The endpoint accepts requests without verifying whether the requested menu item or the linked template has been published. As a result, the plugin returns fully rendered HTML for content that the site owner intended to remain restricted.
An attacker interacts with the endpoint from an unauthenticated network position and receives the rendered output of drafts, private posts, or templates tied to hidden menu entries. This exposes work-in-progress marketing pages, internal announcements, staged product launches, and any confidential content stored as an Elementor template. The disclosure impact is limited to confidentiality, with no integrity or availability effects observed.
The EPSS model currently rates the likelihood of exploitation activity as low, but the endpoint is reachable without credentials, which lowers the operational barrier for opportunistic scanning.
Root Cause
The root cause is missing authorization and post status validation in the plugin's REST handler. The handler resolves menu items and their referenced Elementor templates without calling WordPress capability checks or verifying the post_status field against values such as publish. Any post status, including draft, private, and pending, is treated as renderable when reached through the menu-item lookup path.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker issues an HTTP request to the vulnerable REST route, referencing menu items that resolve to private or draft Elementor templates. The server returns the rendered HTML in the response body. No authentication, user interaction, or elevated privileges are required, and the attack works against default plugin configurations.
Technical exploitation details are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-13402
Indicators of Compromise
- Unauthenticated HTTP requests to /wp-json/ REST routes registered by the Royal Addons for Elementor plugin
- Access log entries containing menu-item or template identifiers correlated with non-published post statuses
- Anomalous response sizes from plugin REST endpoints returning full HTML template output to anonymous clients
Detection Strategies
- Inspect web server access logs for repeated requests to Royal Addons REST endpoints originating from single IP addresses without prior authenticated session cookies
- Correlate REST endpoint responses with the WordPress wp_posts table to identify disclosures of posts where post_status is not publish
- Deploy WAF rules that flag REST calls referencing menu-item IDs mapped to draft or private content
Monitoring Recommendations
- Enable verbose logging on WordPress REST API traffic and forward logs to a centralized analytics platform for correlation
- Alert on spikes in unauthenticated /wp-json/ traffic targeting the Royal Addons plugin namespace
- Track plugin version inventory across managed WordPress installations to identify hosts running versions below 1.7.1063
How to Mitigate CVE-2026-13402
Immediate Actions Required
- Update Royal Addons for Elementor to version 1.7.1063 or later on all affected WordPress installations
- Audit navigation menus for entries referencing draft or private Elementor templates and remove them until patching is complete
- Review web server logs for prior unauthenticated access to plugin REST endpoints to determine if disclosure has already occurred
Patch Information
The vendor addressed the issue in Royal Addons for Elementor version 1.7.1063. The fix adds post status validation and authorization checks to the affected REST endpoint so that draft, private, and pending content is no longer rendered for unauthenticated requesters. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily deactivate the Royal Addons for Elementor plugin until the site can be updated to a patched version
- Restrict access to /wp-json/ REST routes registered by the plugin using web server rules or a WAF policy that requires authentication
- Remove or unpublish sensitive draft and private Elementor templates that are referenced from navigation menu items until remediation is verified
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
