Executive brief
The Royal Addons for Elementor plugin for WordPress contains a security flaw that allows unauthorized individuals to view private website content. Specifically, an attacker can access the text and layout of 'Mega Menu' templates that are still in draft mode or marked as private. This could lead to the exposure of sensitive internal information or upcoming site designs before they are intended for public release.
Technical details
The vulnerability exists in the REST API endpoint `/wpraddons/v1/wprmegamenu/` due to an insufficient permission check and a lack of post-status verification. The `permission_callback` for this route is set to `__return_true`, allowing unauthenticated access. An attacker can provide a `item_id` parameter to the endpoint; the plugin then retrieves and renders the associated Elementor template without checking if the menu item or the template itself is set to 'publish'. By enumerating integer IDs, an attacker can leak the rendered HTML content of private or draft templates used in Mega Menus. This issue is resolved in version 1.7.1063.
Affected products
- WP Royal Royal Elementor Addons < 1.7.1063
Timeline
- 2026-06-26: disclosed: Initial disclosure by researchers
- 2026-07-17: advisory: NVD publication date