CVE-2023-5922 is a high severity (CVSS 7.5 in the record) flaw in the Royal Elementor Addons and Templates WordPress plugin before 1.3.81. An AJAX action returns the content of draft, private and password protected posts to unauthenticated visitors. Update to 1.3.81 or later. WPScan scores it 5.3 Medium.
What's affected
- Plugin: Royal Elementor Addons and Templates for WordPress.
- Affected: versions before 1.3.81.
- Fixed: 1.3.81, per the NVD record and WPScan.
- Severity: 7.5 High in the NVD record. WPScan scores it 5.3 Medium. Neither scores confidentiality loss as critical, but the data exposed is content you meant to keep private.
- Detail: WPScan notes the plugin also has a REST endpoint that is currently disabled.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Royal Elementor Addons and Templates. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Royal Elementor Addons and Templates and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is usually royal-elementor-addons.
A version below 1.3.81 is affected. Next, review what sits in draft, pending and private status on the site, and what is protected by a password. That tells you what could have been read.
What to do now
- Update Royal Elementor Addons to 1.3.81 or later.
- Review drafts, private pages and password protected posts for anything sensitive, such as unreleased announcements, customer information or credentials pasted into notes.
- Change passwords on any protected posts that held sensitive content.
- Check web server logs for repeated calls to the plugin AJAX action from addresses you do not recognize.
- Keep unfinished sensitive content out of WordPress until you are ready to publish it.
Why it matters
The plugin loads post content through an AJAX action but does not confirm that the requester may read that post. WPScan classes it as an insecure direct object reference, CWE-639, where a caller picks an identifier and the server returns the matching record without an ownership check. The record itself lists no weakness identifier.
The scoring gap between sources comes from how they weigh the impact. The data is limited to post content, and an attacker must guess or enumerate identifiers. Still, drafts often hold things that were never meant to be seen yet: embargoed news, pricing, personal data. WordPress treats draft and private status as an access control, so a plugin that bypasses it breaks a promise the site owner made. The record does not list this CVE as known exploited.
Quick check
Are published posts at risk?
No. Published posts are public already. The risk is for content in draft, private or password protected state.
Sources
Last reviewed: 19 October 2026.
