CVE-2025-14610: TableMaster for Elementor SSRF Vulnerability

CVE-2025-14610 Overview

The TableMaster for Elementor plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.3.6. The vulnerability exists because the plugin does not properly restrict which URLs can be fetched when importing CSV data from a URL in the Data Table widget. This allows authenticated attackers with Author-level access or above to make web requests to arbitrary locations, including localhost and internal network services, and read sensitive files such as wp-config.php via the csv_url parameter.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to access internal network services, enumerate internal infrastructure, and exfiltrate sensitive configuration files including WordPress database credentials stored in wp-config.php.

Affected Products

• TableMaster for Elementor plugin for WordPress versions up to and including 1.3.6
• WordPress installations using the affected plugin versions
• Elementor page builder environments with the vulnerable plugin installed

Discovery Timeline

• 2026-01-28 - CVE-2025-14610 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-14610

Vulnerability Analysis

This SSRF vulnerability (CWE-918) exists in the Data Table widget functionality of the TableMaster for Elementor plugin. The vulnerable code is located in the data-table.php file at line 446, where the plugin processes CSV import requests without validating or restricting the destination URLs.

When a user with Author-level privileges or higher attempts to import CSV data, they can specify an arbitrary URL through the csv_url parameter. The plugin makes an HTTP request to this URL server-side without verifying whether the target is an internal resource, a private IP address, or a sensitive local file path. This lack of URL validation enables attackers to probe internal network topology, access cloud metadata endpoints, and read local files that should not be externally accessible.

Root Cause

The root cause of this vulnerability is insufficient input validation on the csv_url parameter in the Data Table widget's CSV import functionality. The plugin fails to implement URL allowlisting or blocklisting mechanisms that would prevent requests to internal IP ranges (such as 127.0.0.1, 10.x.x.x, 192.168.x.x, 169.254.169.254), file protocol handlers, or other dangerous URL schemes.

The absence of server-side URL validation allows the application to act as a proxy, forwarding attacker-controlled requests from the WordPress server to arbitrary destinations. This is particularly dangerous in cloud environments where metadata services can expose sensitive credentials and configuration data.

Attack Vector

The attack vector is network-based and requires authentication with at least Author-level WordPress privileges. An attacker can exploit this vulnerability by:

1. Authenticating to the WordPress admin panel with Author credentials
2. Creating or editing a page using the Elementor editor
3. Adding a Data Table widget from the TableMaster for Elementor plugin
4. Specifying a malicious URL in the csv_url parameter, such as file:///var/www/html/wp-config.php to read local files or http://169.254.169.254/latest/meta-data/ to access cloud metadata
5. The server processes the request and returns the contents, potentially exposing sensitive internal data

The vulnerability allows reading of sensitive files like wp-config.php which contains database credentials, authentication keys, and other critical WordPress configuration parameters.

Detection Methods for CVE-2025-14610

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP addresses (127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16.x.x)
• Web server logs showing requests to cloud metadata endpoints such as 169.254.169.254
• Attempts to access local file paths through the csv_url parameter using file:// protocol
• Unexpected data table imports with URLs pointing to internal services or localhost

Detection Strategies

• Monitor web application logs for Data Table widget requests containing suspicious csv_url values
• Implement Web Application Firewall (WAF) rules to detect SSRF patterns including internal IP addresses and file protocol handlers
• Review WordPress activity logs for Author-level users creating or modifying pages with Data Table widgets
• Deploy network monitoring to detect outbound connections from the WordPress server to internal network ranges

Monitoring Recommendations

• Enable comprehensive logging for the TableMaster for Elementor plugin activity
• Set up alerts for outbound HTTP requests from the web server to RFC 1918 private IP ranges
• Monitor for access attempts to cloud metadata endpoints from web application servers
• Implement egress filtering to restrict outbound connections from the WordPress server

How to Mitigate CVE-2025-14610

Immediate Actions Required

• Update the TableMaster for Elementor plugin to a version newer than 1.3.6 that addresses this vulnerability
• Review user accounts with Author-level access and above, removing unnecessary privileges
• Implement network segmentation to limit the WordPress server's access to internal resources
• Deploy WAF rules to block SSRF attack patterns targeting the csv_url parameter

Patch Information

A patch is available for this vulnerability. Review the WordPress Plugin Change Set for details on the security fix. Additional vulnerability information is available in the Wordfence Vulnerability Report. The vulnerable code can be examined at the WordPress Plugin Source Code.

Workarounds

• Disable the CSV import from URL functionality if not required for business operations
• Restrict Author-level WordPress access to trusted users only until the patch is applied
• Implement server-level egress filtering to prevent outbound connections to internal IP ranges and cloud metadata endpoints
• Consider temporarily deactivating the TableMaster for Elementor plugin until it can be updated