Description (CNA)
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| wproyal / Royal Addons for Elementor – Addons and Templates Kit for Elementor | affected 1.7.1058 through 1.7.1059 |
CWE
CWE-73
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d7ce047b-3cd3-475b-9a9f-38d15174e7e5?source=cve
- https://plugins.trac.wordpress.org/changeset/3532747/royal-elementor-addons
ADP enrichment
No English description supplied.
No references supplied.