CVE-2026-6229: Royal Elementor Addons SSRF Vulnerability

CVE-2026-6229 Overview

CVE-2026-6229 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Royal Elementor Addons plugin for WordPress, affecting all versions up to and including 1.7.1057. The flaw resides in the render_csv_data() function, which performs insufficient validation on user-supplied URLs. Authenticated attackers with Contributor-level access or higher can bypass the URL filter by including the string docs.google.com/spreadsheets in a query parameter. The plugin then passes the attacker-controlled URL to fopen() without blocking internal or private network addresses, enabling requests to arbitrary endpoints.

Critical Impact

Authenticated attackers can pivot through vulnerable WordPress sites to query internal services, cloud metadata endpoints, and private network resources, exposing sensitive data otherwise unreachable from the internet.

Affected Products

• Royal Elementor Addons plugin for WordPress, versions up to and including 1.7.1057
• WordPress sites permitting Contributor-level (or higher) account registration with the plugin enabled
• Hosting environments where the WordPress instance can reach internal network ranges or cloud metadata services

Discovery Timeline

• 2026-05-02 - CVE-2026-6229 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-6229

Vulnerability Analysis

The vulnerability sits in the data-table widget located at modules/data-table/widgets/wpr-data-table.php. The render_csv_data() function accepts a remote URL intended for importing CSV-formatted spreadsheet data. To restrict the feature to Google Sheets exports, the plugin checks whether the supplied URL contains the substring docs.google.com/spreadsheets. This validation is performed against a query parameter rather than the host component of the URL.

An attacker can craft a URL where docs.google.com/spreadsheets appears anywhere in the query string while the actual host points to an internal resource. The plugin treats the URL as legitimate and passes it to fopen(), which performs the outbound HTTP request from the WordPress server. Because the plugin does not enforce host allowlisting or block RFC1918 ranges, IPv6 link-local addresses, or 127.0.0.0/8, the attacker controls the request destination.

Root Cause

The root cause is improper input validation. The plugin relies on substring matching of the full URL string instead of parsing the URL and validating the host. This logic accepts attacker-supplied hosts as long as the magic string appears somewhere in the URL. The use of fopen() for HTTP fetching, without a network-aware wrapper that blocks private IP ranges, compounds the problem.

Attack Vector

An authenticated user with Contributor privileges submits a data-table widget configuration containing a malicious URL such as http://169.254.169.254/latest/meta-data/?docs.google.com/spreadsheets. When the widget renders, the WordPress server issues an HTTP request to the attacker-specified host and returns the response content. This enables enumeration of internal services, retrieval of cloud instance metadata, and exfiltration of sensitive configuration data accessible to the WordPress process.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical references.

Detection Methods for CVE-2026-6229

Indicators of Compromise

• Outbound HTTP requests from the WordPress PHP worker to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or to the cloud metadata endpoint 169.254.169.254.
• Web server access logs showing POST or AJAX requests to admin-ajax.php or Elementor preview endpoints from Contributor-level accounts containing the string docs.google.com/spreadsheets in unexpected query positions.
• New or recently active Contributor accounts saving data-table widget configurations referencing non-Google URLs.

Detection Strategies

• Inspect PHP fopen() and HTTP wrapper telemetry for requests where the host does not match docs.google.com despite the substring being present in the URL.
• Correlate Elementor widget save events with subsequent outbound connections from the WordPress host to internal network ranges.
• Hunt across WordPress audit logs for users with Contributor role creating or editing wpr-data-table widgets.

Monitoring Recommendations

• Enable egress filtering and log all outbound traffic from WordPress hosts, alerting on connections to private IP space or cloud metadata IPs.
• Monitor file modification timestamps under wp-content/plugins/royal-elementor-addons/ to confirm patched versions remain in place.
• Track creation of low-privilege WordPress accounts followed by unusual widget activity within short time windows.

How to Mitigate CVE-2026-6229

Immediate Actions Required

• Update the Royal Elementor Addons plugin to a version newer than 1.7.1057 as soon as a patched release is available from the vendor.
• Audit existing WordPress accounts and remove or downgrade any Contributor-level users that are not strictly required.
• Restrict the WordPress server's outbound network access to deny traffic destined for internal subnets and cloud metadata services.

Patch Information

Review the vendor's fix in the WordPress Plugin Changeset and the affected source in wpr-data-table.php. Apply the latest plugin update via the WordPress admin Plugins page or wp-cli to ensure the render_csv_data() validation is corrected.

Workarounds

• Temporarily disable the Royal Elementor Addons plugin until the patched release is installed.
• Apply a Web Application Firewall rule that rejects requests to Elementor AJAX endpoints containing URL parameters where the host is not docs.google.com.
• Configure cloud instance metadata service v2 (IMDSv2) where available to require session tokens, blocking unauthenticated SSRF probes.

# Example wp-cli commands to mitigate exposure
wp plugin update royal-elementor-addons
wp user list --role=contributor --field=user_login
wp plugin deactivate royal-elementor-addons   # if no patch is yet available