Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-6229 Server-Side Request Forgery in Royal Elementor Addons Plugin for WordPress 1.7.1057 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6229
Post summary
The post presents a new Server‑Side Request Forgery (CVE‑2026‑6229) affecting Royal Elementor Addons Plugin v1.7.1057, with no additional details on exploitation, patches, or current attack activity.