WordPress security changelog
HIGH CVE-2026-17123 Deferred

Royal Elementor Addons webhook setting permits Contributor SSRF

Royal Elementor Addons through 1.7.1064 lets a Contributor place an attacker URL in a Form Builder widget's webhook_url setting and persist it by previewing the draft. The public wpr_form_builder_webhook AJAX handler reads the resulting wpr_webhook_url_{widget_id} option and sends wp_remote_post() without scheme, host, loopback, or private-address checks. A Contributor can therefore make the server query or modify reachable internal services; unauthenticated callers can trigger the already-configured webhook, but setting the target requires Contributor access. Exact request fields beyond webhook_url are not disclosed.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Royal Addons for Elementor – Addons and Templates Kit for Elementor
Plugin slug
royal-elementor-addons
Affected
<= 1.7.1064
Safe version
See mitigation notes
Published
Aug 16, 2026
Weakness
CWE-918 — Server-Side Request Forgery (SSRF)

This CVE was published Aug 16, 2026 and is one of 81 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is identified in the authoritative record. Update when a confirmed patch is available; until then, disable the Form Builder webhook or plugin when warranted and review Contributor content plus outbound and internal-service logs. The official upstream changelog lists version 1.7.1066, which is newer than the published affected range. Its changelog does not clearly confirm this specific fix, so it is not counted as a known-safe release.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render (including a Contributor previewing their own draft), and the wpr_form_builder_webhook AJAX handler — registered for both authenticated and unauthenticated callers — reads that option and dispatches the outbound request via the non-safe wp_remote_post(), with no host allowlist, no scheme restriction, and no private/loopback IP filter (the plugin's existing wpr_is_blocked_remote_host / wpr_is_private_or_local_ip helpers are not called on this path). This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources