CVE-2026-13404 Overview
CVE-2026-13404 is a broken access control vulnerability in the Royal Addons for Elementor WordPress plugin before version 1.7.1066. The plugin writes like-count and visitor-tracking post meta values keyed on an arbitrary post ID without verifying the requester's capability or ownership. Authorization relies solely on a publicly-scrapeable nonce, which does not constitute an access control boundary. Unauthenticated attackers can modify metadata on any post, including private and draft content. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated attackers can manipulate like counts and visitor-tracking metadata on any WordPress post, including unpublished private and draft posts.
Affected Products
- Royal Addons for Elementor WordPress plugin
- Versions prior to 1.7.1066
- WordPress sites using the vulnerable plugin with public frontend endpoints
Discovery Timeline
- 2026-08-26 - CVE-2026-13404 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-13404
Vulnerability Analysis
The Royal Addons for Elementor plugin exposes an AJAX endpoint used to record post likes and visitor counts. The handler accepts a post ID from the client and writes post meta values against that ID. The handler validates only a WordPress nonce token before performing the write. Because the plugin emits this nonce on public pages, any unauthenticated actor can scrape it and reuse it to invoke the endpoint.
The endpoint does not call current_user_can(), does not check post ownership, and does not filter by post status. As a result, attackers can target any post ID, including posts in private, draft, pending, or future status. The impact is limited to integrity of the affected post meta keys, matching the CVSS integrity-only vector.
Root Cause
The root cause is missing authorization on a state-changing endpoint. WordPress nonces defend against cross-site request forgery, not against unauthorized access. The plugin conflates the two controls. This maps directly to CWE-639, where the object identifier is user-controlled and no authorization check gates the operation.
Attack Vector
An unauthenticated remote attacker retrieves a valid nonce from any public page rendered by the plugin. The attacker then submits crafted requests to the vulnerable AJAX action, supplying arbitrary post IDs. Each request increments or overwrites the like-count and visitor-tracking meta keys on the targeted post. Attackers can enumerate post IDs sequentially to reach draft or private content and can pollute analytics or inflate engagement metrics at scale.
See the WPScan Vulnerability Analysis for the disclosed technical details.
Detection Methods for CVE-2026-13404
Indicators of Compromise
- Repeated POST requests to admin-ajax.php referencing Royal Addons like or visitor-tracking actions from a single IP
- Unexpected values in post meta keys tied to like counts or visitor counters on draft or private posts
- Sequential enumeration of post IDs in AJAX request payloads within a short time window
Detection Strategies
- Review web server access logs for high-volume requests to wp-admin/admin-ajax.php with Royal Addons action names and varying post_id parameters
- Query the wp_postmeta table for like or visitor meta rows attached to posts whose post_status is not publish
- Alert on requests from unauthenticated sessions that successfully mutate post meta
Monitoring Recommendations
- Ingest WordPress access and application logs into a centralized SIEM for behavioral analysis
- Baseline normal AJAX action volumes and alert on deviations tied to plugin endpoints
- Track changes to post meta on non-published posts as a high-signal integrity indicator
How to Mitigate CVE-2026-13404
Immediate Actions Required
- Update Royal Addons for Elementor to version 1.7.1066 or later on all affected WordPress sites
- Audit wp_postmeta for anomalous like-count and visitor-tracking values, especially on non-public posts
- Restrict access to admin-ajax.php at the web application firewall where feasible
Patch Information
The vendor addressed the issue in Royal Addons for Elementor version 1.7.1066. Administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan advisory for version confirmation.
Workarounds
- Disable the Royal Addons for Elementor plugin until the update can be applied
- Deploy WAF rules blocking unauthenticated requests to the plugin's like and visitor-tracking AJAX actions
- Remove or restrict frontend widgets that emit the plugin's public nonce to reduce scraping surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
