Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107100— Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content

Quick assessment

Affected
Unknown Royal Addons for Elementor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elementor 的 Royal Addons WordPress 插件在 1.7.1070 版本之前，在未经验证的 AJAX 操作返回内容前，未验证所请求的帖子是否可公开访问；该插件仅依赖帖子的“已发布”状态，而未检查帖子类型的可见性设置。这导致未认证用户可以泄露存储在非公开帖子类型中的内容，例如包含姓名、电子邮件地址和留言的已捕获的联系表单提交数据。

AI Predicted 5.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107100

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content
Source: CVE Program / CVE List V5
Vulnerability Description
The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Royal Addons for Elementor 1.3.81 ~ 1.7.1070 -

II. Public POCs for CVE-2026-107100

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107100

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-28 · 42 CVEs total

CVE-2026-110508 5.3 MEDIUM Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypas
CVE-2026-106648 5.3 MEDIUM Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vi
CVE-2026-103330 5.3 MEDIUM Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature
CVE-2026-103313 5.3 MEDIUM BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Retur
CVE-2026-115223 4.9 MEDIUM Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
CVE-2026-110691 WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update
CVE-2026-103331 UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via
CVE-2026-110524 Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode
CVE-2026-110509 Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via
CVE-2026-110506 Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
CVE-2026-110292 PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Can
CVE-2026-110507 Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop
CVE-2026-106002 Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion
CVE-2026-106003 Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion
CVE-2026-106647 Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget
CVE-2026-107098 Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widge
CVE-2026-107097 Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection vi
CVE-2026-103382 Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confi
CVE-2026-103688 Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
CVE-2026-105972 WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribu

Showing top 20 of 42 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Royal Addons for Elementor
Same vendor: Unknown