PatchSiren cyber security CVE debrief
CVE-2026-6229 wproyal CVE debrief
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.
- Vendor
- wproyal
- Product
- Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVSS
- HIGH 7.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-02
- Original CVE updated
- 2026-08-18
- Advisory published
- 2026-05-02
- Advisory updated
- 2026-08-18
Who should care
Administrators of WordPress installations using the Royal Elementor Addons plugin, security teams monitoring for potential Server-Side Request Forgery attacks, and users with Contributor-level access and above in affected systems.
Technical summary
The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.7.1057 is vulnerable to Server-Side Request Forgery. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function. Authenticated attackers with Contributor-level access and above can exploit this to make requests to arbitrary URLs and retrieve sensitive information from internal services.
Defensive priority
Authenticated attackers with Contributor-level access can exploit this vulnerability to make requests to arbitrary URLs and retrieve sensitive information from internal services.
Recommended defensive actions
- Inventory and version checks for Royal Elementor Addons plugin
- Restrict Contributor-level access and above to necessary personnel
- Implement additional validation for user-supplied URLs
- Monitor for suspicious requests to arbitrary URLs
- Consider compensating controls for internal services
Evidence notes
The vulnerability exists in the Royal Elementor Addons plugin for WordPress versions up to, and including, 1.7.1057. The render_csv_data() function insufficiently validates user-supplied URLs, allowing for Server-Side Request Forgery. This can be exploited by authenticated attackers with Contributor-level access and above.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-02T08:16:27.477Z and has not been modified since then.