blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-5922

HIGH 7.5 CVSS 3.1
Published
January 16, 2024
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content

Affected WordPress components

  • Royal Addons for Elementor – Addons and Templates Kit for Elementor Plugin · royal-elementor-addons
    Confirmed match Active
    Before 1.3.81
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Royal Elementor Addons and Templates — Before 1.3.81
  • royal-elementor-addons royal_elementor_addons — Before 1.3.81

References

  • wpscan.com https://wpscan.com/vulnerability/debd8498-5770-4270-9ee1-1503e675ef34/ Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record