CVE-2026-6229
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to and including 1.7.1057. The issue is due to insufficient validation of user-supplied URLs in the render_csv_data() function.
Risk Assessment
Authenticated attackers with Contributor-level access and above can make requests to arbitrary URLs, potentially leading to the leakage of sensitive information from internal services.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures against unauthorized requests.
Other vulnerabilities in Royal Elementor Addons plugin for WordPress
See all- CVE-2026-4803High
The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'status' parameter in the wpr_update_form_action_meta AJAX action in all versions up to and including 1.7.1056. This is due to insufficient input sanitization and output escaping, combined with a publicly leaked nonce that allows unauthenticated access to the AJAX handler.
- CVE-2023-3709Medium
The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to and including 1.3.70. The API key is added to the source code of any page running the MailChimp block, allowing unauthenticated attackers to obtain the MailChimp API key.
Original NVD description (English source)
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.