---
id: CVE-2026-6229
title: >-
  The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side
  Request Forgery in versions up to, and including, 1.7.1057
summary: >-
  The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side
  Request Forgery in versions up to, and including, 1.7.1057. This is due to
  insufficient validation of user-supplied URLs in the render_csv_data()
  function, whic…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-918
published: '2026-05-02'
updated: '2026-08-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6229'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php#L1832
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php#L1873
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php#L1918
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1049/modules/data-table/widgets/wpr-data-table.php#L2075
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/data-table/widgets/wpr-data-table.php#L1832
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/data-table/widgets/wpr-data-table.php#L1873
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/data-table/widgets/wpr-data-table.php#L1918
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/data-table/widgets/wpr-data-table.php#L2075
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3514363%40royal-elementor-addons&new=3514363%40royal-elementor-addons&sfp_email=&sfph_mail=
    label: security@wordfence.com
  - url: 'https://research.cleantalk.org/cve-2026-6229'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/9744055a-b199-4945-afcc-4f5b85f5f1e8?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00482
epssPercentile: 0.38963
ingestedAt: '2026-08-18T13:17:08.820Z'
---

## Overview

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.