CVE-2026-13404 — Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

CVE-2026-13404

Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init PUBLISHED

Description (CNA)

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

Affected (CNA)

Vendor / product	Versions
Unknown / Royal Addons for Elementor	affected 0 before 1.7.1066

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c4915a6c-8bf5-46aa-8134-ea490bd6137f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.