Detections
Analytics
CVE-2026-13404
medium
Description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.
References
https://wpscan.com/vulnerability/c4915a6c-8bf5-46aa-8134-ea490bd6137f/