Cyber Resilience

CVE-2026-28135

High

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS Score 0.0023 13.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-28135 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-28135 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability (CWE-829) in the Royal Elementor Addons WordPress plugin (royal-elementor-addons). It enables accessing functionality not properly constrained by ACLs. The vulnerability affects all versions of the plugin from n/a through 1.7.1052 and was published on 2026-03-05.

With a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), the flaw can be exploited by unauthenticated attackers over the network with low attack complexity and no user interaction required. Successful exploitation results in low impact to integrity and high impact to availability, while confidentiality remains unaffected.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1049-other-vulnerability-type-vulnerability?_s_id=cve provides details on the vulnerability, including information relevant to versions like 1.7.1049.

OWASP Top 10 for Web (2025)

A08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability details

Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.

CWE(s)
CWE-829

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated inclusion/access flaw in public-facing WordPress plugin directly enables exploitation via T1190; limited impact details (no RCE) preclude additional mappings such as execution or impact techniques.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-62726Shared CWE-829
CVE-2020-36905Shared CWE-829
CVE-2025-68924Shared CWE-829
CVE-2025-27668Shared CWE-829
CVE-2025-70974Shared CWE-829
CVE-2025-70046Shared CWE-829
CVE-2024-49649Shared CWE-829
CVE-2025-11023Shared CWE-829
CVE-2026-40903Shared CWE-829
CVE-2025-0982Shared CWE-829

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations and ACLs to directly prevent unauthenticated access to unconstrained functionality in the Royal Elementor Addons plugin.

AC-6 Least Privilege partial match
prevent

Implements least privilege to restrict access to plugin functionality, mitigating unauthorized exploitation by limiting necessary permissions.

SI-2 Flaw Remediation good match
preventrecover

Identifies, reports, and remediates the specific flaw in Royal Elementor Addons versions <=1.7.1052 through timely patching.

References