The identified flaw is a Server‑Side Request Forgery (SSRF) that allows an authenticated user with Contributor or higher privileges to inject arbitrary URLs into the Form Builder widget's webhook settings. The plugin stores the URL in an option that is read by the AJAX handler, which then forwards a request using wp_remote_post() without any safety checks. As a result, the attacker can cause the web application to send requests to any network endpoint, including internal servers or external services, enabling data exfiltration or manipulation of remote resources. The vulnerability satisfies the criteria of CWE‑918.

This issue affects the Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin distributed by wproyal. All installations running version 1.7.1064 or earlier are impacted. The vulnerability was discovered in the Form Builder widget handling of the 'webhook_url' option. Users of any WordPress site that have installed or upgraded to these versions are therefore exposed until updated.

The CVSS score of 8.8 indicates a high severity, and while the EPSS score is currently unavailable, the lack of an allowlist or private‑IP filter means the attack can reach internal hosts. The vulnerability is accessible to contributors, who are commonly present on content‑heavy sites, and can be triggered simply by rendering a form. The plugin's AJAX endpoint is exposed to unauthenticated callers, so even if an attacker cannot authenticate, a form preview triggers the payload. Because the flaw can be abused for internal scanning or to exfiltrate data, the risk is significant, though the absence of active exploitation data prevents a definitive EPSS assessment. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS justifies immediate remediation.