The Royal Elementor Addons plugin (before version 1.7.1066) performs no capability or ownership checks when processing requests to the wpr_likes_init endpoint. It relies only on a publicly accessible nonce, allowing any user, including unauthenticated ones, to write to the post meta that stores like counts and visitor‑tracking information. The consequence is that attackers can alter like statistics and logged visitor IPs for any post, including private or draft content, thereby manipulating public perception or tracking user activity in a privacy‑violating manner. This vulnerability is a classic example of missing authorization on a write operation, which can lead to data integrity and confidentiality breaches.

WordPress sites using the Royal Elementor Addons (Royal Addons for Elementor) plugin with a version older than 1.7.1066. The vulnerability specifically targets the post‑meta keys that store like counts and visitor‑tracking data and applies to all posts, regardless of status (public, private, or draft).

An attacker only needs to execute a simple HTTP request to the wpr_likes_init endpoint, providing a valid public nonce. No additional authentication is required. The probability of exploitation is high because the endpoint is accessible to all visitors and can be discovered via public enumeration or by examining the plugin’s JavaScript. While no EPSS or KEV ranking is available, the serious impact on data integrity and potential privacy violations warrants a high‑risk assessment. With no remediation in place, any unauthenticated user can repeatedly alter like counters and visitor logs until an update is applied.