CVE-2026-17585: Royal Addons Information Disclosure Flaw

CVE-2026-17585 Overview

CVE-2026-17585 affects the Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress. The vulnerability allows unauthenticated attackers to extract arbitrary postmeta values from all published posts. Exploitation abuses the wpr_keyword parameter in the plugin's AJAX search handler to perform character-by-character substring matching across the entire wp_postmeta table. The nonce required for the AJAX endpoint is emitted publicly through wp_localize_script on any frontend page loading a Royal Elementor widget, removing the need for authentication. The issue is classified as sensitive information exposure [CWE-200].

Critical Impact
Unauthenticated attackers can enumerate private postmeta contents across all published posts, potentially exposing credentials, license keys, private form data, and other sensitive metadata stored by third-party plugins.

Affected Products

Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress
All versions up to and including 1.7.1066
WordPress sites loading any Royal Elementor widget on public pages

Discovery Timeline

2026-09-12 - CVE-2026-17585 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-17585

Vulnerability Analysis

The flaw resides in the plugin's AJAX search module classes/modules/wpr-ajax-search.php. The handler accepts a wpr_keyword parameter from unauthenticated requests and uses it in queries against the wp_postmeta table without restricting which meta keys or values can be searched. By supplying incremental substrings and observing whether matching records are returned, an attacker can reconstruct arbitrary meta values one character at a time. This blind-extraction pattern is functionally similar to a boolean-based information disclosure oracle. Because the search is performed across all published posts and all meta rows associated with them, the exposure is not limited to fields the plugin itself renders on the frontend.

Root Cause

The root cause is a combination of overly broad query scope and public exposure of the AJAX nonce. The plugin's search logic queries wp_postmeta without an allowlist of safe meta keys, and the nonce protecting the endpoint is emitted client-side via wp_localize_script (see plugin.php line 655). Any anonymous visitor can request a page containing a Royal Elementor widget, harvest the nonce, and issue crafted AJAX requests. Referenced source lines include line 23, line 115, and line 155 of wpr-ajax-search.php in tagged versions 1.7.1061 and 1.7.1064.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker retrieves the AJAX nonce from any public page rendering a Royal Elementor widget. The attacker then submits repeated AJAX requests to the search endpoint, varying the wpr_keyword parameter to test candidate substrings against wp_postmeta. Response differences reveal whether the guessed substring exists, enabling character-by-character reconstruction of stored metadata values. The vulnerability is described in the Wordfence Vulnerability Report and in the WordPress plugin source at line 115.

Detection Methods for CVE-2026-17585

Indicators of Compromise

High-volume AJAX POST requests to admin-ajax.php with action=wpr_ajax_search or similar Royal Elementor search actions from a single source.
Repeated requests containing the wpr_keyword parameter with incrementally varying short substrings.
Anonymous clients requesting frontend pages solely to harvest localized script data containing the search nonce.

Detection Strategies

Monitor web server logs for bursts of AJAX requests targeting Royal Elementor search endpoints with short or single-character wpr_keyword values.
Alert on identical AJAX endpoints being hit hundreds or thousands of times from the same IP or session within a short window.
Correlate frontend page requests with subsequent AJAX search activity to identify nonce-harvesting patterns.

Monitoring Recommendations

Enable WordPress access logging and forward records to a centralized log platform for query analysis.
Track rate and diversity of wpr_keyword values per client to surface enumeration behavior.
Review database slow query logs for repeated LIKE patterns against wp_postmeta originating from the plugin's search handler.

How to Mitigate CVE-2026-17585

Immediate Actions Required

Update the Royal Addons for Elementor plugin to a version newer than 1.7.1066 once a fixed release is available from the vendor.
Audit wp_postmeta contents for sensitive data such as credentials, tokens, or API keys and rotate any exposed secrets.
Restrict access to the plugin's AJAX search endpoint at the web server or WAF layer if a patch is not yet installed.

Patch Information

All versions up to and including 1.7.1066 are affected. Site administrators should consult the plugin's WordPress.org listing and the Wordfence Vulnerability Report for the latest fixed version and upgrade guidance. Verify the installed version against the plugin changelog after updating.

Workarounds

Temporarily disable the Royal Elementor search widget on all frontend pages to prevent public emission of the AJAX nonce.
Deploy a Web Application Firewall (WAF) rule to block or rate-limit requests to the wpr_ajax_search action.
Remove or unregister the plugin's AJAX search handler via a custom mu-plugin until the official patch is applied.

bash

# Example WAF rule concept: rate-limit Royal Elementor AJAX search requests
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:429,id:1017585,msg:'Rate limit wpr_ajax_search'"
  SecRule ARGS:action "@streq wpr_ajax_search" \
    "chain"
    SecRule IP:REQ_COUNT "@gt 20"