The Royal Addons for Elementor plugin is vulnerable to unauthenticated sensitive information exposure. An attacker can retrieve any post meta value from the wp_postmeta table by exploiting the wpr matching. Because the nonce required for the request is publicly emitted via wp_localize_script on any frontend page that loads a Royal widget, no authentication or prior action is required. The flaw demonstrates a weakness in input validation and improper authentication, classified as CWE‑200.

The affected product is the Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress, versions up to and including 1.7.1066. Administrators should verify that their installations do not contain these versions.

The CVSS score of 5.3 reflects a moderate severity impact on confidentiality, as arbitrary metadata can be read. The EPSS score <1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in attack vector is through a public HTTP endpoint that accepts the wpr_keyword parameter. An attacker simply crafts a request to the endpoint to iterate over possible meta values, which is feasible without user interaction or privileges.