CVE-2026-13404

Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

We have discovered 69,726 live websites that are affected by CVE-2026-13404.

Run a Free Instant Scan



Affected Software

Product  Royal Elementor Addons
Category Wordpress Plugins
Vulnerable Domains69,726 live websites (100% of Royal Elementor Addons install base)
Vulnerable Versions
  • from 0 through 1.7.1066
Vulnerable Versions Count156 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-639 Authorization Bypass Through User-Controlled Key



Details

  • Published - Aug 26, 2026
  • Updated - Aug 26, 2026

Credits

  • Shivamani Vastrala (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-13404
United States14,914 websites


Germany7,439 websites
France5,900 websites
Brazil5,634 websites
India3,892 websites
Italy3,691 websites
GB2,399 websites
Spain2,333 websites
Cyprus2,289 websites
Poland1,427 websites

Website Distribution by TLD

Number of websites using CVE-2026-13404
.com27,659 websites
.com.br5,148 websites
.de4,244 websites
.org3,017 websites
.fr2,868 websites
.it2,702 websites
.net1,292 websites
.co.uk1,206 websites
.pl1,098 websites
.nl1,032 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13404

Top websites that are affected by CVE-2026-13404. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States*,***
*******.**.uk United States*,***
*********************.fr France**,***
*********.gr Greece**,***
******.com United States**,***
********.no Norway**,***
******.cc Malaysia**,***
*******************.org Mexico**,***
****************.***.ar Argentina**,***
*********.net Germany**,***
See full domain list

FAQ

CVE-2026-13404 is Authorization Bypass Through User-Controlled Key in Royal Elementor Addons
A total of 69,726 websites have been identified as vulnerable to CVE-2026-13404, based on global website indexing conducted by WebTechSurvey.
The Royal Elementor Addons is affected by the CVE-2026-13404 vulnerability.
Royal Elementor Addons versions up to 1.7.1066 are vulnerable to CVE-2026-13404.
CVE-2026-13404 is resolved in version 1.7.1066 of Royal Elementor Addons.