Technical impact
The Royal Elementor Addons plugin (before version 1.7.1066) performs no capability or ownership checks when processing requests to the wpr_likes_init endpoint. It relies only on a publicly accessible nonce, allowing any user, including unauthenticated ones, to write to the post meta that stores like counts and visitor‑tracking information. The consequence is that attackers can alter like statistics and logged visitor IPs for any post, including private or draft content, thereby manipulating public perception or tracking user activity in a privacy‑violating manner. This vulnerability is a classic example of missing authorization on a write operation, which can lead to data integrity and confidentiality breaches.
Affected Systems
WordPress sites using the Royal Elementor Addons (Royal Addons for Elementor) plugin with a version older than 1.7.1066. The vulnerability specifically targets the post‑meta keys that store like counts and visitor‑tracking data and applies to all posts, regardless of status (public, private, or draft).
Risk and Exploitability
An attacker only needs to execute a simple HTTP request to the wpr_likes_init endpoint, providing a valid public nonce. No additional authentication is required. The EPSS score of <1% indicates a low probability of exploitation, despite the endpoint being universally accessible and discoverable via public enumeration or plugin JavaScript. The CVSS score of 5.3 indicates a moderate risk, and the vulnerability is not listed in CISA KEV. With no remediation in place, any unauthenticated user can repeatedly alter like counters and visitor logs until an update is applied.
