# CVE-2026-13406: Royal Addons for Elementor unauthenticated taxonomy disclosure

Source: https://junglewise.ai/threats/cve-2026-13406-royal-addons-for-elementor-unauthenticated-taxonomy-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13406 · Severity: medium · CVSS 5.3 · Published 2026-08-26

The Royal Addons for Elementor WordPress plugin contains a flaw that exposes private taxonomy data without requiring authentication. An attacker can query the plugin's endpoint to retrieve names and IDs of taxonomy terms from private/non-public taxonomies that WordPress intentionally hides from public access, potentially exposing sensitive business categorization or internal segmentation of content.

## Quick answers

**Is CVE-2026-13406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13406 being exploited in the wild.

**How severe is CVE-2026-13406?** Medium severity, with a CVSS score of 5.3, published 26 August 2026.

**Which products and versions are affected?** Royal Addons Royal Addons for Elementor before 1.7.1066.

**Is there a fix for CVE-2026-13406?** A patch was published on 2026-08-26: Fixed in version 1.7.1066 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13406 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13406?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (broken access control) in the plugin's wpr_get_dependent_terms AJAX action. The endpoint accepts arbitrary taxonomy names and parent term IDs without verifying user capabilities or validating nonce tokens, allowing unauthenticated callers to enumerate taxonomy terms. The root cause is the absence of capability checks (current_user_can) and nonce validation before returning term data from private taxonomies that WordPress core does not expose via REST API or public archives. An attacker can POST to wp-admin/admin-ajax.php with action=wpr_get_dependent_terms, taxonomy=<private_taxonomy>, and parent_term=<guess_or_enumerate> to retrieve all terms assigned to published posts. The vulnerability was fixed in version 1.7.1066.

## Affected products

- Royal Addons Royal Addons for Elementor before 1.7.1066

## Timeline

- 2026-08-24: disclosed
- 2026-08-26: patched: Fixed in version 1.7.1066

## References

- [https://wpscan.com/vulnerability/44b457b8-5759-4d1d-b6fd-9dfe19a249a6/](https://wpscan.com/vulnerability/44b457b8-5759-4d1d-b6fd-9dfe19a249a6/)