CVE-2023-5922: The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint…

PriorityP344high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.71%

48.9th percentile

The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content

Affected

1 ranges

Vendor	Product	Version range	Fixed in
royal-elementor-addons	royal_elementor_addons	< 1.3.81	1.3.81

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.