The vulnerability is a Server‑Side Request Forgery (SSRF) in the WP Royal Royal Elementor Addons plugin. It permits an attacker to cause the web server to issue HTTP(S) requests to arbitrary URLs. This could lead to disclosure of internal resources, data exfiltration, or denial of service. The weakness is described by CWE‑918, which represents an inadequate validation of user‑supplied input that results in arbitrary URL fetches.

Affected systems are installations of the WordPress plugin Royal Elementor Addons by WP Royal, version 1.7.1006 or earlier. The plugin is distributed via WordPress and integrated into WordPress sites; any site using a vulnerable version is at risk.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation. Since the vulnerability is not in the CISA KEV catalog, there is no evidence of active exploitation. Attackers would likely need to interact with a vulnerable site’s exposed endpoints, which could be triggered by a unauthenticated user or a user with plugin configuration privileges. Even with modest exploitation probability, the ability to reach internal networks remains a concern in highly protected environments.