Information disclosure in Royal Addons For Elementor

CVE-2026-107100

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.

Vulnerability class: Information Disclosure

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.002 (5.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 5.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

  • Royal Addons For Elementor

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-107100?
CVE-2026-107100 is a medium-severity vulnerability in Royal Addons For Elementor, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-10-28.
How severe is CVE-2026-107100?
Medium severity. CVSS v3 base score is 5.3 out of 10.