The Royal Addons for Elementor plugin for WordPress suffers from a missing capability check on the wpr_update_form_action_meta AJAX action. The handler is registered on both authenticated and unauthenticated hooks and verifies a nonce that is publicly exposed in front‑end JavaScript, removing effective protection. Because the endpoint calls update_post_meta() directly with user‑controlled input for a set of form action meta keys, any unauthenticated visitor can alter critical form configuration data such as email recipients, Mailchimp lists, and webhook URLs. This can lead to unauthorized notifications or direct data exfiltration via hijacked webhook URLs.

WordPress sites that have Royal Addons for Elementor – Addons and Templates Kit for Elementor version 1.7.1056 or earlier are affected. The flaw exists in all releases up to and including 1.7.1056; any site using one of those releases without an update is at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable by an unauthenticated attacker who merely visits a page that loads a Royal Addons widget; no login or privileged access is required. Once accessed, the attacker can modify sensitive form configuration data without restriction.