What the vulnerability does
01Description
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues.
Explanation of Vulnerability in Simple Terms
02Summary
Royal Addons for Elementor contains an access control flaw that allows authenticated users to modify site content or availability. A logged-in user with low privileges can alter data or disrupt service without requiring additional user interaction. The vulnerability affects versions up to 1.3.59. Update to a version newer than 1.3.59 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify site content or cause service disruption as an authenticated low-privilege user.
Potential impact on your site
04Site Impact
Any logged-in user, including subscribers or contributors, can alter content or cause downtime.
Conditions required to exploit
05Prerequisites
Attacker must have a valid login account with low-level privileges on the site.
Key dates
06Disclosure timeline
January 10, 2023
CVE published
April 8, 2026
Record updated
