CVE-2026-13406

Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.

We have discovered 69,726 live websites that are affected by CVE-2026-13406.

Run a Free Instant Scan



Affected Software

Product  Royal Elementor Addons
Category Wordpress Plugins
Vulnerable Domains69,726 live websites (100% of Royal Elementor Addons install base)
Vulnerable Versions
  • from 0 through 1.7.1066
Vulnerable Versions Count156 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 26, 2026
  • Updated - Aug 26, 2026

Credits

  • Meher Sudhakar Abbireddi (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-13406
United States14,914 websites


Germany7,439 websites
France5,900 websites
Brazil5,634 websites
India3,892 websites
Italy3,691 websites
GB2,399 websites
Spain2,333 websites
Cyprus2,289 websites
Poland1,427 websites

Website Distribution by TLD

Number of websites using CVE-2026-13406
.com27,659 websites
.com.br5,148 websites
.de4,244 websites
.org3,017 websites
.fr2,868 websites
.it2,702 websites
.net1,292 websites
.co.uk1,206 websites
.pl1,098 websites
.nl1,032 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13406

Top websites that are affected by CVE-2026-13406. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********.com United States*,***
*******.**.uk United States*,***
*********************.fr France**,***
*********.gr Greece**,***
******.com United States**,***
********.no Norway**,***
******.cc Malaysia**,***
*******************.org Mexico**,***
****************.***.ar Argentina**,***
*********.net Germany**,***
See full domain list

FAQ

CVE-2026-13406 is Missing Authorization in Royal Elementor Addons
A total of 69,726 websites have been identified as vulnerable to CVE-2026-13406, based on global website indexing conducted by WebTechSurvey.
The Royal Elementor Addons is affected by the CVE-2026-13406 vulnerability.
Royal Elementor Addons versions up to 1.7.1066 are vulnerable to CVE-2026-13406.
CVE-2026-13406 is resolved in version 1.7.1066 of Royal Elementor Addons.