The TableMaster for Elementor plugin for WordPress is vulnerable to Server‑Side Request Forgery in all versions up to 1.3.6. The flaw occurs because the plugin does not restrict the URLs that can be fetched when importing CSV data via the 'csv_url' parameter. An authenticated user with Author-level access and above can supply any URL, causing the plugin to perform web requests on their behalf. This allows the attacker to reach arbitrary locations, including localhost and internal network services, and read sensitive files such as wp-config.php. The weakness is a classic example of CWE‑918: Server‑Side Request Forgery.

Vendor bloompixel offers TableMaster for Elementor – Advanced Responsive Tables for Elementor. All plugin releases up to and including version 1.3.6 are affected.

The CVSS score of 7.2 indicates a medium severity flaw. The EPSS score of less than 1% suggests that, at the time of analysis, exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated author‑level or higher attacker with access to the Data Table widget, who supplies a crafted 'csv_url' value. Once exploited, the attacker can read sensitive configuration files or access internal resources, leading to potential data exposure and compromise of the site’s integrity.