Green Hat Security Advisory · GH-ADV-2026-007

CVE-2026-97255

Unauthenticated IDOR in Royal Elementor Addons

Royal Elementor Addons through 1.7.1069 contains an unauthenticated IDOR vulnerability. Patchstack credits Anthony Green of GreenHat Security and identifies 1.7.1070 as the fixed version.

Medium · CVSS 5.3PatchedPublished

CVE assignment and research role

Assigning CNA: Patchstack. Green Hat Security's role in this record is Researcher; Green Hat did not assign this CVE ID. View the Patchstack record ↗

Overview

Summary

Royal Elementor Addons through 1.7.1069 contains an unauthenticated IDOR vulnerability. Patchstack credits Anthony Green of GreenHat Security and identifies 1.7.1070 as the fixed version.

Vulnerability Classification

Vulnerability type

Insecure Direct Object Reference (IDOR)

Weakness

CWE-639

Affected component

Object-level authorization

CVSS 3.1

5.3 · Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Security Impact

An unauthenticated network caller can bypass an access-control boundary through a user-controlled object reference and expose information. The published CVSS 3.1 vector rates confidentiality impact as Low, with no integrity or availability impact and no required victim interaction.

Affected Products

Royal Elementor Addons WordPress plugin — affected versions: 1.7.1069 and earlier. The CVE record lists unaffected as its default status for versions outside the stated range.

Component: Object-level authorization

Fixed version: 1.7.1070 or later

Technical Details

The CVE classifies the issue as CWE-639: authorization bypass through a user-controlled key. This class of flaw occurs when a caller can select an object without the server enforcing permission to access it. The public CVE and Patchstack entry do not identify the affected endpoint or the specific fields disclosed. The checklist below applies the published weakness classification to defensive review; it does not describe a new lab reproduction.

This public record provides enough information to identify the vulnerability and its root cause without unnecessarily publishing weaponized exploit material.

Defensive lesson

An object identifier tells the server which record is requested. Authorization must independently establish whether this caller may read it, including when the caller is anonymous.

Research method

Defensive Review Checklist

  1. 1. Separate object selection from permission

    For each request that accepts an object identifier, trace the lookup and the access decision separately. Confirm that the server checks whether the caller may read that specific object before serializing a response.

  2. 2. Include anonymous requests in the test matrix

    Use synthetic records in an authorized test environment. Compare a permitted read with requests for restricted and nonexistent records, including requests without login cookies. Check both the response status and returned fields.

  3. 3. Preserve intended public access when testing the fix

    After updating, verify that restricted records stay protected while intentionally public objects remain available. Keep the same fixtures and caller states so a changed result can be traced to the authorization fix.

Attack Requirements

  • A reachable WordPress installation running an affected Royal Elementor Addons version.
  • The published vector requires no authenticated account or victim interaction.
  • A request reaching the affected object-access functionality; the public sources do not specify its endpoint or configuration prerequisites.

Remediation

Fixed version: 1.7.1070 or later

Guidance: Update Royal Elementor Addons to version 1.7.1070 or later.

  • Confirm the installed plugin version after updating each affected WordPress site.
  • Retest object-level access in a test environment using synthetic records and anonymous requests.
  • Use the CVE and Patchstack advisory to track the security fix; the plugin changelog describes 1.7.1070 only as a minor-bug release.

Disclosure Timeline

  1. Reported to Patchstack

    Patchstack's timeline records Anthony Green's report on August 16.

  2. Fixed version released

    The plugin changelog dates version 1.7.1070 to October 23. Patchstack and the CVE identify this version as fixed.

  3. Advisory and CVE published

    Patchstack published the advisory and CVE record with Anthony Green credited as finder.

Patchstack's Low priority label is an operational assessment, separate from the CVE's Medium CVSS severity of 5.3. Dates, affected versions, and credit follow the public records; the review checklist is general defensive guidance.

Researcher Credit

  • Anthony Green [antnation] — Green Hat Security

Coordination and CVE Attribution

Anthony Green of GreenHat Security reported the issue through the Patchstack Bug Bounty Program. Patchstack coordinated disclosure and assigned CVE-2026-97255.

Green Hat Security did not reserve or assign the CVE ID.

Patchstack's Low priority label is an operational assessment, separate from the CVE's Medium CVSS severity of 5.3. Dates, affected versions, and credit follow the public records; the review checklist is general defensive guidance.

References