CVE-2026-17123: SSRF in Royal Elementor Addons WordPress Plugin

The Royal Elementor Addons plugin for WordPress (versions 1.7.1064 and below) contains a critical Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-17123. The issue stems from the Form Builder widget, specifically its webhook functionality. When a user with Contributor-level access or higher previews a draft, the widget's render method saves a user-supplied URL into the 'wpr_webhook_url_{widget_id}' option. Subsequently, the AJAX handler 'wpr_form_builder_webhook' retrieves this value and executes an outbound request via 'wp_remote_post()'. Critically, this execution path fails to invoke existing internal security helpers designed to block requests to private or loopback IP addresses, nor does it enforce host allowlisting or scheme validation. This oversight enables an attacker to force the server to interact with internal network resources, potentially leading to unauthorized data access or the manipulation of internal services residing within the hosting environment.

Impact

Successful exploitation allows authenticated attackers to perform SSRF attacks, enabling them to scan internal networks, interact with local services that lack external authentication, or exfiltrate sensitive configuration data from the internal infrastructure. Given the ubiquity of WordPress installations, this vulnerability poses a significant risk to organizations hosting internal or private services within the same network segment as their public web servers.

Recommendation

• Immediately update the Royal Elementor Addons plugin to the latest available version beyond 1.7.1064, which contains the patch for CVE-2026-17123.
• Audit access logs for the 'wpr_form_builder_webhook' AJAX action to identify potentially malicious requests originating from Contributor-level user accounts.
• Implement strict egress filtering at the network level on web servers to prevent unauthorized connections from the application server to internal IP segments.
• Review all custom webhook integrations for similar 'wp_remote_post()' usage that bypasses standard sanitization helper functions.