CVE-2026-28135
Published: 05 March 2026
Summary
CVE-2026-28135 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations and ACLs to directly prevent unauthenticated access to unconstrained functionality in the Royal Elementor Addons plugin.
Implements least privilege to restrict access to plugin functionality, mitigating unauthorized exploitation by limiting necessary permissions.
Identifies, reports, and remediates the specific flaw in Royal Elementor Addons versions <=1.7.1052 through timely patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated inclusion/access flaw in public-facing WordPress plugin directly enables exploitation via T1190; limited impact details (no RCE) preclude additional mappings such as execution or impact techniques.
NVD Description
Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.
Deeper analysisAI
CVE-2026-28135 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability (CWE-829) in the Royal Elementor Addons WordPress plugin (royal-elementor-addons). It enables accessing functionality not properly constrained by ACLs. The vulnerability affects all versions of the plugin from n/a through 1.7.1052 and was published on 2026-03-05.
With a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), the flaw can be exploited by unauthenticated attackers over the network with low attack complexity and no user interaction required. Successful exploitation results in low impact to integrity and high impact to availability, while confidentiality remains unaffected.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1049-other-vulnerability-type-vulnerability?_s_id=cve provides details on the vulnerability, including information relevant to versions like 1.7.1049.
Details
- CWE(s)