CVE-2026-107100 — MEDIUM (5.3)

Vulnerability Description

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-200

References

https://wpscan.com/vulnerability/12d7734c-ef28-445b-9625-5ba0271e9fa7/

FAQ

What is CVE-2026-107100?

CVE-2026-107100 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying onl...

How severe is CVE-2026-107100?

CVE-2026-107100 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-107100?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.