# Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1070 - Authenticated (Contributor+) Sensitive Information Exposure via Nested Elementor Template Rendering

- **ID:** WPSEC-2026-2844
- **Plugin:** Royal Addons for Elementor – Addons and Templates Kit for Elementor (`royal-elementor-addons`), https://wordpress.org/plugins/royal-elementor-addons/
- **Affected versions:** all versions before 1.7.1071
- **Fixed in:** 1.7.1071 (Update to 1.7.1071 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/royal-elementor-addons
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2844/

## Description

The Royal Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via nested template rendering in all versions up to, and including, 1.7.1070, due to missing post status checks when rendering Elementor templates by ID in several widgets (such as Tabs, Advanced Accordion, Advanced Slider, Content Toggle, Off-Canvas, Unfold, Countdown, Elementor Template, Password Protected Content and the Display Conditions fallback template) and in the 'wpr_ppc_verify_password' AJAX handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed draft, pending or private Elementor-built posts and templates in their own content and read the rendered content.

## References

- https://wpsec.com/vuln/WPSEC-2026-2844/
- https://plugins.svn.wordpress.org/royal-elementor-addons/tags/1.7.1071/
- https://wordpress.org/plugins/royal-elementor-addons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2844/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.