CVE-2025-26990: Royal Elementor Addons SSRF Vulnerability

CVE-2025-26990 Overview

CVE-2025-26990 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the WP Royal Royal Elementor Addons plugin for WordPress. The flaw affects all versions of the plugin up to and including 1.7.1006. An authenticated attacker with high privileges can coerce the WordPress server into issuing arbitrary HTTP requests to attacker-chosen destinations. This behavior enables reconnaissance of internal network resources and interaction with services that are not otherwise reachable from the internet.

Critical Impact
Authenticated attackers can pivot through the vulnerable WordPress instance to reach internal services, cloud metadata endpoints, or other restricted assets, leading to sensitive information disclosure.

Affected Products

WP Royal Royal Elementor Addons (royal-elementor-addons) for WordPress
All versions from unspecified initial release through 1.7.1006
WordPress sites running the plugin with authenticated high-privilege user accounts

Discovery Timeline

2025-04-15 - CVE-2025-26990 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26990

Vulnerability Analysis

The vulnerability resides in the Royal Elementor Addons plugin, a widget and template library that extends the Elementor page builder. The plugin exposes functionality that accepts a user-supplied URL and issues a server-side HTTP request without adequate validation of the destination host. This class of flaw is tracked as CWE-918: Server-Side Request Forgery.

Exploitation requires an authenticated session with high privileges on the WordPress instance. Successful abuse compromises confidentiality by returning response data from targets the attacker could not otherwise reach. The vulnerability does not directly modify data or degrade service availability.

Root Cause

The plugin fails to enforce an allowlist of permitted destinations or block requests to private, loopback, and link-local address ranges. Because the request originates from the WordPress host, it inherits any implicit trust granted to that host by internal firewalls or cloud identity metadata services.

Attack Vector

An attacker authenticated to the WordPress admin surface submits a crafted request to the vulnerable plugin endpoint, supplying a target URL. The server retrieves the URL and returns response content or metadata to the attacker. Common SSRF targets include cloud instance metadata endpoints, internal REST APIs, and databases bound to loopback interfaces. See the Patchstack SSRF Vulnerability Report for the disclosure record.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-26990

Indicators of Compromise

Outbound HTTP requests originating from the WordPress PHP worker to internal RFC1918 address ranges, 127.0.0.1, or 169.254.169.254.
Unexpected web server log entries showing high-privileged user sessions invoking Royal Elementor Addons AJAX or REST endpoints with URL parameters.
Cloud provider metadata service access logs from the WordPress instance IP without corresponding legitimate workload activity.

Detection Strategies

Inspect PHP-FPM and web server access logs for plugin endpoints receiving user-controlled URL parameters from authenticated administrator or editor sessions.
Correlate WordPress audit logs with egress firewall telemetry to identify server-initiated requests toward non-public destinations.
Deploy a web application firewall rule that flags requests to Royal Elementor Addons endpoints containing URL schemes pointing at internal networks.

Monitoring Recommendations

Alert on any request from the WordPress host to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Baseline normal outbound HTTP destinations for the WordPress server and flag deviations for review.
Track privileged user activity within WordPress and review sessions that interact with plugin update, import, or fetch functionality.

How to Mitigate CVE-2025-26990

Immediate Actions Required

Update the Royal Elementor Addons plugin to a version later than 1.7.1006 as soon as a fixed release is available from the vendor.
Audit WordPress user accounts and revoke high-privilege roles from users that do not require them, reducing the attack surface for authenticated exploitation.
Restrict egress network access from the WordPress host to only the destinations required for legitimate operation.

Patch Information

Refer to the Patchstack advisory for the current patched version and vendor guidance. Apply plugin updates through the WordPress admin dashboard or via wp-cli.

Workarounds

Temporarily disable the Royal Elementor Addons plugin until an updated version is installed on production sites.
Block outbound traffic from the WordPress host to private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses at the network firewall.
Enforce Instance Metadata Service Version 2 (IMDSv2) on cloud-hosted WordPress instances to require session tokens for metadata requests.

bash

# Configuration example: disable the plugin via wp-cli pending patch
wp plugin deactivate royal-elementor-addons

# Example iptables rule blocking egress from PHP worker to cloud metadata
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT