Server-Side Request Forgery Vulnerability in Royal Elementor Addons by WP Royal
CVE-2025-26990

4.4MEDIUM

Key Information:

Vendor

WordPress
Status
Royal Elementor Addons
Vendor
CVE Published:
15 April 2025

What is CVE-2025-26990?

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Royal Elementor Addons plugin by WP Royal. This flaw allows an attacker to manipulate the server to make unauthorized requests on behalf of the application, potentially exposing sensitive information or enabling further exploitation. The vulnerability impacts all versions from n/a to 1.7.1006, which highlights the urgency for updates and secure coding practices to mitigate such risks.

Affected Version(s)

Royal Elementor Addons <= 1.7.1006

References

https://patchstack.com/database/wordpress/plugin/royal-el...
vdb-entry

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marek Mikita (Patchstack Alliance)
.