Skip to content
Threat Feed
Subscribe
low advisory

WP Royal Elementor Addons: Information disclosure vulnerability

A remote, authenticated attacker can exploit a vulnerability in the Royal Elementor Addons plugin for WordPress to gain unauthorized access to sensitive information.

Triage facts

Revision 1
Applicability
Royal Elementor Addons
Evidence
Unknown
Severity
Low
Action
Monitor or close
Sources
1 public source
Freshness
Revision 1Nov 9, 16:09 UTC
Source quality
A1Roughly even chance

The Royal Elementor Addons plugin for WordPress is affected by an information disclosure vulnerability. A remote, authenticated attacker can leverage this flaw to access information that should otherwise be restricted. This vulnerability requires the attacker to have an active, authenticated session within the WordPress environment.

Recommendation

  • Audit WordPress plugin installations and identify all instances of "Royal Elementor Addons".
  • Ensure the plugin is updated to the latest available version provided by WP Royal to incorporate any security fixes.
  • Review WordPress access logs to identify authenticated user activity associated with suspicious plugin endpoint requests.

Immediate actions

Inventory Royal Elementor Addons instances across WordPress sites.

IT Operations 7d

Threat Hunt

Monitor web server access logs for anomalous, high-frequency GET or POST requests directed at plugin-specific API endpoints from authenticated users.

T1592 low low confidence monitor or close

Data: Web server access logs (Apache/Nginx/IIS), WordPress authentication logs