VulnSocial

CVE-2026-28135General

MEDIUMCVSS 8.2 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-829

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-03-05); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-05: 1Mentions · 2026-04-06: 1Active Exploitation · 2026-04-06: 1Patch / Workaround · 2026-04-06: 1Technical Details · 2026-04-06: 103-0504-06
Signal classification2 categories
General
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-03-051
General1
2026-04-061
Patch1
Full discourse2 posts
  • SwissWPSecure@Swisswpsecure
    Patch

    🔴 WP ALERT — April 6, 2026 4 active CVEs. Act today: 🔴 W3 Total Cache CVE-2026-27384 (CVSS 9.8) — RCE, no login needed → update to 2.9.2 🔴 Royal Elementor CVE-2026-28135 — no reliable patch → DELETE it 🟠 Gutenverse CVE-2026-2924 — Stored XSS → update to 3.4.7 🟠 Ally CVE-2026-2413 — blind SQLi, unauthenticated → update to 4.0.4+ Exploits hit in 5hrs median. SwissWPSuite WAF + Sentinel blocks 3 of 4. Royal Elementor must be deleted — we tell you the truth. Full brief → https://swisswpsecure.com/%f0%9f%94%b4-wordpress-security-alert-april-6-2026-4-active-threats-you-must-act-on-today/ #WPSec #WordPress 🛡️

    Post summary

    The alert announces four urgent WordPress CVEs, provides specific patch/version updates or deletion instructions, highlights active exploitation, and urges immediate action.

    0001049
    1 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-28135 Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Pr… https://www.cve.org/CVERecord?id=CVE-2026-28135

    Post summary

    The post references CVE‑2026‑28135 and provides a link to its CVE record, but offers no additional details about the vulnerability, its exploitation, or mitigation.

    00000158
    56.6K followersView on X

Explore more

Back to dashboard