Royal Elementor Addons contains a Broken Access Control flaw. The plugin fails to enforce proper authorization checks, allowing an unauthenticated or low‑privilege user to act with higher privileges within the plugin. This can result in unauthorized viewing or modification of plugin settings and content, potentially affecting the confidentiality, integrity, or availability of the WordPress site. The weakness is identified as CWE‑862.

The vulnerability affects all releases of Royal Elementor Addons with a version number less than 1.7.1053, including the original release. The plugin is distributed under the WProyal brand and is deployed on WordPress installations. A site that has not upgraded to 1.7.1053 or newer is at risk, regardless of other WordPress security measures.

The CVSS score of 5.3 indicates a moderate risk. No EPSS score is currently available, so the exact exploitation probability cannot be quantified, but the lack of a KEV listing reduces certainty of real‑world attacks. The flaw is likely exploitable remotely through legitimate WordPress web traffic, as the plugin’s admin interfaces are accessible to users who can achieve higher authority without proper checks. An attacker could use this to elevate privileges or steal data.