What is the CVSS score of CVE-2026-6229?

CVE-2026-6229 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Royal Elementor Addons are affected by CVE-2026-6229?

CVE-2026-6229 is a Server-Side Request Forgery vulnerability in Royal Elementor Addons (WordPress plugin) versions up to 1.7.1057 that allows attackers to bypass URL validation and access sensitive…

How to fix or mitigate CVE-2026-6229?

Within 24 hours: Audit WordPress plugin inventory to identify all instances of Royal Elementor Addons and confirm installed versions against 1.7.1057 baseline; isolate affected WordPress instances from internal network access if possible. Within 7 days: Contact vendor for patch timeline and interim security guidance; implement Web Application Firewall (WAF) rules to block requests containing 'docs.google.com/spreadsheets' URL parameters to known vulnerable endpoints; restrict network access from WordPress application servers to sensitive internal services (databases, metadata endpoints, administrative interfaces). Within 30 days: Apply vendor-released patch immediately upon availability; perform access log analysis to detect exploitation attempts; conduct internal network segmentation review to limit blast radius of SSRF from web tier.

Royal Elementor Addons CVE-2026-6229

EUVD-2026-26757 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-02 Wordfence

WordPress Google SSRF Royal Addons For Elementor Addons And Templates Kit For Elementor Wordpress Plugin Wproyal

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 08:16 vuln.today

EUVD ID Assigned

May 02, 2026 - 08:00 euvd

EUVD-2026-26757

Analysis Generated

May 02, 2026 - 08:00 vuln.today

CVE Published

May 02, 2026 - 07:46 nvd

HIGH 7.2

DescriptionCVE.org

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

AnalysisAI

Server-Side Request Forgery (SSRF) in Royal Elementor Addons plugin for WordPress allows authenticated attackers with Contributor-level permissions to bypass URL validation by including 'docs.google.com/spreadsheets' in query parameters, enabling requests to arbitrary internal URLs and retrieval of sensitive data from private network services. Affects versions up to 1.7.1057. The CVSS vector indicates network-based attack with no authentication required (PR:N), contradicting the description's statement of Contributor-level requirement-affected site operators should verify actual privilege requirements with vendor advisory. No active exploitation confirmed (not in CISA KEV), but detailed source code references enable rapid POC development.

Technical ContextAI

This vulnerability exists in the Royal Addons for Elementor plugin's data-table module, specifically in the render_csv_data() function within wpr-data-table.php. The flaw stems from CWE-918 (Server-Side Request Forgery) where user-supplied URLs are passed to PHP's fopen() function without proper validation of the destination address. The plugin attempts to restrict URLs but implements a bypassable allowlist check-if a URL contains 'docs.google.com/spreadsheets' anywhere in its query parameters, validation passes even if the actual target is an internal service (localhost, 169.254.x.x, 10.x.x.x ranges, etc.). The affected CPE is cpe:2.3:a:wproyal:royal_addons_for_elementor_-_addons_and_templates_kit_for_elementor:*:*:*:*:*:*:*:* versions through 1.7.1057. WordPress plugins with Contributor-level access typically allow content creation but not publication, and if this role can invoke Elementor widgets with arbitrary parameters, the attack surface expands significantly.

RemediationAI

Apply the vendor-released patch by upgrading Royal Elementor Addons to version 1.7.1058 or later, as evidenced by the WordPress plugin repository changeset 3514363 at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3514363%40royal-elementor-addons&new=3514363%40royal-elementor-addons&sfp_email=&sfph_mail=, which addresses the vulnerable render_csv_data() function. If immediate patching is not feasible, implement compensating controls: restrict Contributor-level user permissions to only trusted personnel (reducing attack surface if authentication is indeed required), disable the Royal Elementor Addons Data Table widget entirely through Elementor's widget management interface until patching is complete, or implement Web Application Firewall (WAF) rules to block requests containing 'docs.google.com/spreadsheets' in unusual contexts while monitoring for bypass attempts (trade-off: may impact legitimate Google Sheets integration features). For defense-in-depth, configure WordPress hosting environment network policies to block outbound requests from the web server to internal IP ranges (RFC1918 private addresses, link-local 169.254.0.0/16, localhost) at the firewall or container network level, though this may disrupt other plugins requiring local service access.