Quick answers
- Is CVE-2026-13404 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13404 being exploited in the wild.
- How severe is CVE-2026-13404?
- Medium severity, with a CVSS score of 5.3, published 26 August 2026.
- Which products and versions are affected?
- Royal Elementor Royal Addons for Elementor before 1.7.1066.
- Is there a fix for CVE-2026-13404?
- A patch was published on 2026-08-26: Fixed in version 1.7.1066 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13404 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-13404?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the wpr_likes_init AJAX action. The plugin fails to validate user capabilities or post ownership before writing post metadata (_post_like_count, _post_like_modified, _user_IP), relying only on a publicly-scrapeable WordPress nonce. Since WordPress issues a shared nonce (user-0) to anonymous visitors, an attacker can scrape this nonce from any public page rendering a Post Likes element, then replay it anonymously against any post ID, including those the attacker has no access to. The attacker can then increment like counts and inject arbitrary IP addresses via the Client-IP header. No authentication is required; the attack is purely network-based and exploits broken access control on the AJAX endpoint.
Affected products
- Royal Elementor Royal Addons for Elementor before 1.7.1066
Timeline
- 2026-08-24: disclosed: Publicly published vulnerability
- 2026-08-26: patched: Fixed in version 1.7.1066