CVE-2026-2373

MEDIUM EPSS 10.1%

Published Mar 17, 20263mo ago · Modified Jun 17, 20262w ago

5.3 CVSS 3.1

Medium

Published Mar 17, 2026 3mo ago

Last Modified Jun 17, 2026 2w ago

Description

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.

CVSS Details

Base Score

5.3

Exploitability

3.9

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

10.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

References 2

plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3475656/
wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/c4192a7f-b962-46f9-a524-7271ed6f4917?source=cve

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.