CVE-2026-6229

Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter

2026-05-01 00:00
Dmitrii Ignatyev

Strategic Overview

Status
Patched in 1.7.1058
Affected Plugin
Royal Addons for Elementor – Addons and Templates Kit for Elementor
Affected Version
<= 1.7.1057
CVSS
7.2High
Weakness type
CWE-918 · Server-Side Request Forgery (SSRF)
CVE
CVE-2026-6229
View all Royal Addons for Elementor – Addons and Templates Kit for Elementor vulnerabilities

At a glance

CVE-2026-6229 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the Royal Addons for Elementor WordPress plugin, affecting versions <= 1.7.1057. It carries a CVSS score of 7.2 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.7.1058; sites on affected versions should update now. Disclosed May 2026, reported by Dmitrii Ignatyev.

Vulnerability Overview

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-918: Server-Side Request Forgery (SSRF)

Royal Addons for Elementor <= 1.7.1057 carries this weakness at render_csv_data(), and reaching it takes an account at Contributor level or above. Server-side request forgery means the application fetches a URL supplied by the caller, turning the server into a proxy for requests the attacker could not make directly.

The request originates from inside the hosting network, which is how these flaws reach cloud metadata endpoints, internal admin panels and services that trust local traffic. For Royal Addons for Elementor the fix is 1.7.1058: builds <= 1.7.1057 are affected, anything from 1.7.1058 onward is not.

Remediation

Update to version 1.7.1058, or a newer patched version

How does WordSec protect against this?

An attacker needs Contributor access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Royal Addons for Elementor 1.7.1058 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-6229https://www.wordfence.com/threat-intel/vulnerabilities/id/9744055a-b199-4945-afcc-4f5b85f5f1e8https://nvd.nist.gov/vuln/detail/CVE-2026-6229

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C