The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to information exposure because its get_main_query_args() function does not enforce proper authorization on which custom post types can be retrieved. As a result, unauthenticated attackers can extract content from non‑public custom post types, such as Contact Form 7 submissions or WooCommerce coupons. This represents a confidentiality breach that could expose user data, marketing campaign details, or other sensitive information that was intended to remain private.

This vulnerability affects all installations of the wproyal:Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin with version numbers up to and including 1.7.1049. No other vendors or products are listed as affected.

With an overall CVSS score of 5.3 the vulnerability is rated medium in severity. The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalogue. Because the flaw can be exploited without any authentication, any visitor to the site can trigger the get_main_query_args() function and retrieve non‑public content, making the risk moderate to high for sites that use such custom post types. No special environmental conditions are required for exploitation.