EUVD-2026-59863
GHSA-mgg8-m984-r93c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
S:C reflects SSRF crossing to internal systems; C:L and I:L capture bounded impact on secondary services; A:N as availability disruption is not a primary outcome; PR:L confirmed by contributor requirement.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render (including a Contributor previewing their own draft), and the wpr_form_builder_webhook AJAX handler - registered for both authenticated and unauthenticated callers - reads that option and dispatches the outbound request via the non-safe wp_remote_post(), with no host allowlist, no scheme restriction, and no private/loopback IP filter (the plugin's existing wpr_is_blocked_remote_host / wpr_is_private_or_local_ip helpers are not called on this path). This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
AnalysisAI
Server-Side Request Forgery in Royal Elementor Addons for WordPress (versions ≤1.7.1064) allows authenticated Contributor-level users to persistently configure a malicious webhook URL via the Form Builder widget, which is then dispatched by an AJAX handler registered for both authenticated and unauthenticated callers - meaning the trigger phase requires no authentication at all. The root flaw is that wp_remote_post() is invoked on the stored URL with no host allowlist, no scheme restriction, and no private/loopback IP filtering, despite the plugin containing wpr_is_blocked_remote_host and wpr_is_private_or_local_ip helpers that are simply not called on this code path. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability (CWE-918, Server-Side Request Forgery) exists across two distinct code paths in the Royal Elementor Addons plugin (CPE: cpe:2.3:a:wproyal:royal_addons_for_elementor_-_addons_and_templates_kit_for_elementor:*:*:*:*:*:*:*:*). First, the Form Builder widget's render() method - in wpr-form-builder.php at approximately line 3788 - writes the attacker-supplied webhook_url into the WordPress options table under the key wpr_webhook_url_{widget_id} on every render, including when a Contributor merely previews a draft. Second, the wpr_form_builder_webhook AJAX handler in wpr-send-webhook.php (line 20, triggered at line 56) reads that option without sanitization and passes it directly to WordPress's wp_remote_post(). The plugin possesses IP filtering helpers but they are not invoked in this code path, making the bypass structural rather than logic-based. This design allows the two-phase attack: a low-privilege user plants the URL, and the unauthenticated AJAX surface acts as the trigger.
RemediationAI
No vendor-released patch identified at time of analysis - the available references point exclusively to vulnerable source code in tags 1.7.1064 and 1.7.1061, and no fixed version number is present in the input data. Administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8810200b-e026-4258-86aa-5c1a200fcf9b for a patched release and upgrade immediately when available. As a compensating control, disable the Form Builder widget's Webhook integration in plugin settings if the feature is not operationally required - this removes the wpr_webhook_url_{widget_id} write path entirely. Additionally, restrict the Contributor role from creating or editing pages with Elementor widgets until a patch is applied; this eliminates the URL-planting phase. Network-level controls on the WordPress server that block outbound HTTP/HTTPS to RFC1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and loopback will mitigate the most dangerous internal-service-pivoting use cases, though they add operational overhead and may break legitimate webhook integrations.
Stored Cross-Site Scripting in Royal Elementor Addons WordPress plugin allows unauthenticated remote attackers to inject
Server-Side Request Forgery (SSRF) in Royal Elementor Addons plugin for WordPress allows authenticated attackers with Co
Arbitrary file read in Royal Addons for Elementor versions 1.7.1058-1.7.1059 allows authenticated attackers with Contrib
Stored Cross-Site Scripting in Royal Addons for Elementor's Instagram Feed widget allows authenticated contributors and
Stored Cross-Site Scripting in Royal Addons for Elementor plugin versions up to 1.7.1056 allows authenticated attackers
Stored cross-site scripting in Royal Elementor Addons plugin for WordPress up to version 1.7.1056 allows authenticated a
Stored Cross-Site Scripting (XSS) in Royal Addons for Elementor plugin allows authenticated contributors and above to in
Unauthenticated sensitive information exposure in the Royal Addons for Elementor WordPress plugin (all versions ≤1.7.106
Unauthenticated attackers can extract sensitive data from non-public custom post types in Royal Addons for Elementor Wor
Unauthenticated attackers can modify form action metadata on WordPress posts through the Royal Addons for Elementor plug
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today