Aller au contenu
en Se connecter
7.2 Élevée

CVE-2026-6229 The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and…

Description

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

Produits et versions touchés

Produit Versions touchées Corrigé en
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7 premières → 1.7.1057 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Royal Addons for Elementor – Addons and Templates Kit for Elementor

Les 60 CVE de Royal Addons for Elementor – Addons and Templates Kit for Elementor →
CVE-2026-17585 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to… 5.3 Moyenne CVE-2026-17123 The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and… 8.8 Élevée CVE-2026-8118 The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to… 6.5 Moyenne CVE-2026-6504 The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… 6.4 Moyenne
Suivre cette CVE