Skip to content
fr Sign in
7.2 High

CVE-2026-6229 The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and…

Description

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

Affected products and versions

Product Affected versions Fixed in
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7 earliest → 1.7.1057 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Royal Addons for Elementor – Addons and Templates Kit for Elementor

The 60 CVEs of Royal Addons for Elementor – Addons and Templates Kit for Elementor →
CVE-2026-17585 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to… 5.3 Medium CVE-2026-17123 The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and… 8.8 High CVE-2026-8118 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to… 6.5 Medium CVE-2026-6504 The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… 6.4 Medium
Track this CVE