CVE-2026-13402— Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Royal Addons for Elementor | < 1.7.1063 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13402
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress Royal Addons for Elementor 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Royal Addons for Elementor是WordPress基金会的一款为Elementor页面构建器提供额外功能的WordPress插件集合。 WordPress Royal Addons for Elementor 1.7.1063版本之前版本存在信息泄露漏洞，该漏洞源于REST端点未检查菜单项或所引用模板的文章状态，可能导致未经身份验证的用户检索非公开导航菜单项所链接的私人或草稿Elementor模板的渲染HTML内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Royal Addons for Elementor | 0 ~ 1.7.1063 | - |
II. Public POCs for CVE-2026-13402
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13402
请登录查看更多情报信息。
News Coverage for CVE-2026-13402 (1)
- 🔗 Royal Elementor Addons < 1.7.1063 – Unauthenticated Private Mega Menu Template Disclosure | CVE 2026-13402 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-17 · 7 CVEs total
| CVE-2026-9810 | AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation vi | |
| CVE-2026-11961 | User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound | |
| CVE-2026-11966 | User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe | |
| CVE-2026-11575 | PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback | |
| CVE-2026-10525 | NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission | |
| CVE-2026-12393 | WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation v |
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-14184
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and - CVE-2026-14185
WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update - CVE-2026-14183
Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Dis - CVE-2026-13694
Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Auth - CVE-2026-8082
Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Inject
V. Comments for CVE-2026-13402
No comments yet