VulnSocial

CVE-2026-13402Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-17: 2Technical Details · 2026-07-17: 207-17
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-13402 The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpo… https://www.cve.org/CVERecord?id=CVE-2026-13402 ----- Traducción: CVE-2026-13402 The… http://infoflow.cloud`

    Post summary

    The post highlights CVE‑2026‑13402, revealing a flaw in Royal Addons for Elementor where menu items and templates are not validated in a REST endpoint; it offers no PoC, exploit, patch, or evidence of active exploitation.

    0000031
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-13402 The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpo… https://www.cve.org/CVERecord?id=CVE-2026-13402

    Post summary

    The post describes a new CVE for Royal Addons for Elementor, noting a missing post‑status check in a REST endpoint, but provides no PoC, exploit, patch, or active‑use information.

    00000614
    57.8K followersView on X

Explore more

Back to dashboard