CVE-2026-6229: Royal Elementor Addons Plugin Vulnerable to SSRF

The National Vulnerability Database has disclosed CVE-2026-6229, a high-severity Server-Side Request Forgery (SSRF) vulnerability impacting the Royal Elementor Addons plugin for WordPress, affecting versions up to and including 1.7.1057. The flaw stems from insufficient validation of user-supplied URLs within the render_csv_data() function. Attackers can bypass existing validation by including ‘docs.google.com/spreadsheets’ in a query parameter, allowing subsequent fopen() calls to access arbitrary URLs without proper internal or private network address blocking.

This vulnerability enables authenticated attackers, specifically those with Contributor-level access or higher, to craft malicious requests. Their objective: to force the WordPress instance to make requests to internal services or arbitrary external URLs. The critical impact here is the potential for information disclosure, allowing attackers to retrieve sensitive data from internal systems or pivot further into the network.

For defenders, this is a clear call to action. The attacker’s calculus is straightforward: leverage a common plugin with broad access to internal resources. A successful SSRF can bypass perimeter defenses, exposing internal APIs, cloud metadata, or even sensitive files accessible via local network services. It’s a critical initial foothold for lateral movement and data exfiltration.