Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/12d7734c-ef28-445b-9625-5ba0271e9fa7 İstismar kodu ya da analiz

Kayıt geçmişi

1. 28 Eki 2026 21:10CVSS puanı değişti: – → 5.3
2. 28 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-107097Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe
• 6,8 CVE-2026-107098Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting
• 3,8 CVE-2026-106647Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision
• 5,7 CVE-2026-105617PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule
• 5,7 CVE-2026-105616PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting
• 2,7 CVE-2026-113494GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode