The Royal Elementor Addons plugin for WordPress is vulnerable to Server‑Side Request Forgery (SSRF) in versions up to 1.7.1057. Inadequate validation of user‑supplied URLs in the render_csv_data() function lets attackers inject URLs such as those pointing to Google Sheets. The plugin then uses these URLs directly in fopen() calls without preventing internal or private network addresses from being contacted, enabling an authenticated user with Contributor level or higher to make arbitrary HTTP requests and retrieve sensitive information from internal services.

Affected systems are WordPress sites running the Royal Elementor Addons – Addons and Templates Kit for Elementor plugin in any version 1.7.1057 or earlier. Sites that have not applied the latest patch from the Royal Addons maintainers remain vulnerable.

The CVSS score of 7.2 indicates high impact, and while the EPSS score is not available the vulnerability can be actively exploited by authenticated users with Contributor level or higher. The lack of a CISA KEV listing means no public exploit kit is confirmed, but the weakness can still be leveraged through credential compromise or internal phishing. Administrators should treat this as a high‑priority patching issue, especially for sites where contributor access is broadly distributed.