# CVE-2026-17585

## Summary

- **CVE ID:** CVE-2026-17585
- **Severity:** MEDIUM
- **CVSS Score:** 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **CWE:** CWE-200
- **Published:** Sep 12, 2026
- **Last Modified:** Sep 14, 2026

## Description

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.

## Affected Products

- wproyal — Royal Addons for Elementor – Addons and Templates Kit for Elementor (0)

## References

- [CNA](https://www.wordfence.com/threat-intel/vulnerabilities/id/5eab79e6-cb47-4fe7-993a-e833bd6689f8?source=cve)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/wpr-ajax-search.php#L155)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/wpr-ajax-search.php#L115)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/classes/modules/wpr-ajax-search.php#L23)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1064/plugin.php#L655)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/wpr-ajax-search.php#L155)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/wpr-ajax-search.php#L115)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/classes/modules/wpr-ajax-search.php#L23)
- [CNA](https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1061/plugin.php#L655)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.32%
- **EPSS Percentile:** 25.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._