CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
Authenticated users with manage_options capability can execute arbitrary PHP code via unsanitized widget markup in Royal Elementor Addons.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13405?
CVE-2026-13405 is a medium-severity code injection vulnerability in Unknown Royal Addons for Elementor, published on 20 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
Weakness: CWE-94
Which versions are affected by CVE-2026-13405?
How do I fix CVE-2026-13405?
No fix has been published for CVE-2026-13405 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-13405 being exploited?
There is no known exploitation of CVE-2026-13405 in the wild and no public exploit code.
Sources
Also known as GHSA-7mpg-36pq-7j9r.