CVE-2026-13406: Royal Addons Information Disclosure Flaw

CVE-2026-13406 Overview

CVE-2026-13406 is a missing authorization vulnerability in the Royal Addons for Elementor WordPress plugin before version 1.7.1066. The plugin exposes an AJAX handler that returns taxonomy term data for any caller-supplied taxonomy name. The handler performs neither a capability check nor a nonce validation before responding. Unauthenticated attackers can query non-public taxonomies and enumerate the names and IDs of their terms. The issue is tracked under CWE-862: Missing Authorization and reported through the WPScan Vulnerability Report.

Critical Impact
Unauthenticated remote callers can enumerate terms of arbitrary taxonomies, including private ones, exposing internal content structure and identifiers.

Affected Products

Royal Addons for Elementor WordPress plugin, all versions before 1.7.1066
WordPress sites running the vulnerable plugin with default configuration
Sites that expose non-public taxonomies through custom post types or private content workflows

Discovery Timeline

2026-08-26 - CVE-2026-13406 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13406

Vulnerability Analysis

The Royal Addons for Elementor plugin registers an AJAX endpoint that returns taxonomy term data based on a taxonomy name provided in the request. The handler accepts requests from unauthenticated users and does not verify the caller's WordPress capabilities. It also omits a nonce check, so requests originating from any source are accepted.

The attacker supplies an arbitrary taxonomy slug in the request parameters. The handler passes that value to WordPress term-lookup functions and returns the resulting term names and IDs in the response. Because the taxonomy name is not restricted to a set of public, plugin-owned taxonomies, an attacker can request non-public taxonomies used by other plugins or custom code.

The disclosed data is limited to term names and IDs, so confidentiality impact is bounded. However, the exposed identifiers can support content enumeration, targeted follow-on requests, and reconnaissance of private site structure.

Root Cause

The root cause is a broken access control pattern in the AJAX handler. WordPress requires plugins to enforce their own capability and nonce checks on wp_ajax_* and wp_ajax_nopriv_* endpoints. The vulnerable handler is registered for unauthenticated callers and neither calls current_user_can() nor check_ajax_referer() before returning taxonomy data. This matches the [CWE-862] pattern of missing authorization on a sensitive operation.

Attack Vector

Exploitation requires only network access to the WordPress site's admin-ajax.php endpoint. The attacker sends a single HTTP request with the action parameter for the vulnerable handler and a target taxonomy name. No authentication, user interaction, or elevated privileges are required. See the WPScan Vulnerability Report for endpoint details.

// No verified public exploit code is available.
// Refer to the WPScan advisory for endpoint and parameter details.

Detection Methods for CVE-2026-13406

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-admin/admin-ajax.php that reference the Royal Addons taxonomy action with a taxonomy parameter set to a non-public taxonomy slug
Bursts of admin-ajax.php requests from a single source iterating through taxonomy names
Responses from admin-ajax.php that return JSON payloads containing term IDs and names for taxonomies not used on public pages

Detection Strategies

Inspect web server access logs for repeated calls to admin-ajax.php with the plugin's AJAX action and varying taxonomy values
Deploy a web application firewall rule that flags unauthenticated admin-ajax.php requests referencing the vulnerable action
Correlate anomalous admin-ajax.php volume with the installed plugin version reported by the site's asset inventory

Monitoring Recommendations

Track the installed version of Royal Addons for Elementor across all managed WordPress sites and alert on versions below 1.7.1066
Monitor for outbound scraping patterns following successful taxonomy enumeration responses
Baseline normal admin-ajax.php action frequencies and alert on new or spiking action names

How to Mitigate CVE-2026-13406

Immediate Actions Required

Update Royal Addons for Elementor to version 1.7.1066 or later on every affected WordPress site
Audit admin-ajax.php access logs for prior taxonomy enumeration attempts against non-public taxonomies
Restrict access to the WordPress admin surface behind a WAF or IP allowlist where feasible

Patch Information

The vendor addressed the issue in Royal Addons for Elementor version 1.7.1066. Upgrade through the WordPress plugin manager or WP-CLI. Verify the installed version after the update. Additional details are available in the WPScan Vulnerability Report.

Workarounds

Disable or remove the Royal Addons for Elementor plugin until the patched version can be deployed
Add a WAF rule that blocks unauthenticated requests to admin-ajax.php referencing the vulnerable action
Restrict admin-ajax.php access to authenticated sessions where the site's functionality allows it

bash

# Update the plugin using WP-CLI
wp plugin update royal-elementor-addons --version=1.7.1066
wp plugin get royal-elementor-addons --field=version