CVE-2026-2373: Royal Addons Information Disclosure Flaw

CVE-2026-2373 Overview

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.

Critical Impact

Unauthenticated attackers can extract sensitive data from non-public custom post types, potentially exposing confidential form submissions, coupon codes, and other protected content stored in WordPress.

Affected Products

• Royal Addons for Elementor plugin versions up to and including 1.7.1049
• WordPress installations using the affected plugin
• Sites with sensitive custom post types (Contact Form 7, WooCommerce coupons)

Discovery Timeline

• 2026-03-17 - CVE CVE-2026-2373 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-2373

Vulnerability Analysis

This Information Exposure vulnerability (CWE-862: Missing Authorization) exists in the Royal Addons for Elementor WordPress plugin. The core issue stems from the get_main_query_args() function failing to properly validate and restrict which post types can be queried. This missing authorization check allows unauthenticated users to craft requests that retrieve data from custom post types that should be restricted to authenticated users or administrators only.

The vulnerability is particularly concerning because WordPress sites commonly store sensitive information in custom post types. Contact Form 7 submissions may contain personal user data, while WooCommerce coupons could include promotional codes with significant financial value. The lack of proper access controls in the vulnerable function exposes all of this data to external attackers without requiring any authentication.

Root Cause

The root cause of this vulnerability is a Missing Authorization (CWE-862) flaw in the get_main_query_args() function. The function fails to implement sufficient restrictions to verify whether the requesting user has appropriate permissions to access specific post types. Without proper authorization checks, the function accepts and processes requests for any post type, including those marked as private or non-public, allowing data extraction from restricted content areas.

Attack Vector

The attack is network-based and can be executed by unauthenticated remote attackers. An attacker can exploit this vulnerability by sending specially crafted requests to a WordPress site running the vulnerable plugin. By manipulating the query parameters handled by the get_main_query_args() function, attackers can specify non-public custom post types and retrieve their contents.

The attack does not require user interaction and can be automated to systematically extract sensitive data from vulnerable WordPress installations. Attackers can target specific post types known to contain valuable data, such as form submissions containing personal information or e-commerce coupon codes.

Detection Methods for CVE-2026-2373

Indicators of Compromise

• Unusual or unexpected queries to WordPress REST API endpoints requesting custom post types
• Log entries showing access attempts to non-public post type data from unauthenticated sessions
• Anomalous traffic patterns targeting Elementor-related plugin endpoints

Detection Strategies

• Monitor web server access logs for requests containing post type parameters targeting sensitive data types like wpcf7_contact_form or WooCommerce coupon post types
• Implement Web Application Firewall (WAF) rules to detect and block suspicious query patterns targeting the Royal Addons plugin
• Review WordPress activity logs for unusual data access patterns from unauthenticated users

Monitoring Recommendations

• Enable detailed logging on WordPress installations to capture all API and plugin-related requests
• Configure alerts for repeated requests to custom post type endpoints from single IP addresses
• Monitor for data exfiltration indicators such as large response sizes to unauthenticated requests

How to Mitigate CVE-2026-2373

Immediate Actions Required

• Update Royal Addons for Elementor plugin to a version newer than 1.7.1049 immediately
• Review server logs for any signs of exploitation targeting the vulnerable function
• Audit sensitive custom post types for any unauthorized access or data exposure
• Consider temporarily disabling the plugin if an update is not immediately available

Patch Information

A security fix has been released to address this vulnerability. The patch is available through the WordPress plugin repository. Site administrators should update to the latest version of Royal Addons for Elementor as documented in the WordPress Changeset Update. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement server-level access restrictions to limit requests to sensitive WordPress endpoints
• Use a Web Application Firewall (WAF) to filter malicious requests targeting the vulnerable function
• Restrict access to the WordPress REST API for unauthenticated users if not required for site functionality
• Consider implementing additional authentication requirements for any custom post type queries

# Example: Restrict access to REST API for unauthenticated users in .htaccess
# Add to WordPress .htaccess file to limit REST API access
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>