CVE-2026-28135 HIGH

CVE-2026-28135: WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability

Vendor Wp Royal
Product Royal Elementor Addons
Weakness CWE-829 · Inclusion from untrusted sphere
Published March 5, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.

Explanation of Vulnerability in Simple Terms

02Summary

Royal Elementor Addons versions up to 1.7.1052 contain an integrity vulnerability allowing network-based attacks without authentication. An attacker can modify data or functionality on affected sites. The vulnerability has low availability impact. Update to a version newer than 1.7.1052 to remediate.

What an attacker can do

03Attacker Capabilities

Modify site data or functionality without needing to log in.

Potential impact on your site

04Site Impact

Site content or behavior could be altered by remote attackers without your knowledge or consent.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

March 5, 2026 CVE published
April 29, 2026 Record updated