PatchSiren cyber security CVE debrief
CVE-2026-6229 wproyal CVE debrief
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.
- Vendor
- wproyal
- Product
- Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVSS
- HIGH 7.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-02
- Original CVE updated
- 2026-08-18
- Advisory published
- 2026-05-02
- Advisory updated
- 2026-08-18
Who should care
Administrators of WordPress installations using the Royal Elementor Addons plugin, security teams monitoring for potential Server-Side Request Forgery attacks, and users with Contributor-level access and above in affected systems.
Technical summary
The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.7.1057 is vulnerable to Server-Side Request Forgery. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function. Authenticated attackers with Contributor-level access and above can exploit this to make requests to arbitrary URLs and retrieve sensitive information from internal services.
Defensive priority
Authenticated attackers with Contributor-level access can exploit this vulnerability to make requests to arbitrary URLs and retrieve sensitive information from internal services.
Recommended defensive actions
- Inventory and version checks for Royal Elementor Addons plugin
- Restrict Contributor-level access and above to necessary personnel
- Implement additional validation for user-supplied URLs
- Monitor for suspicious requests to arbitrary URLs
- Consider compensating controls for internal services
Evidence notes
The vulnerability exists in the Royal Elementor Addons plugin for WordPress versions up to, and including, 1.7.1057. The render_csv_data() function insufficiently validates user-supplied URLs, allowing for Server-Side Request Forgery. This can be exploited by authenticated attackers with Contributor-level access and above.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-6229 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-6229
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-6229 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6229
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/data-table/widgets/wpr-data-table.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/data-table/widgets/wpr-data-table.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/data-table/widgets/wpr-data-table.php
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.