CVE-2025-26990 WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability

What is CVE-2025-26990?

CVE-2025-26990 is a medium-severity server-side request forgery vulnerability in Royal-Elementor-Addons Royal Elementor Addons, published on 15 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1006.

Weakness: CWE-918

Which versions are affected by CVE-2025-26990?

It affects 1 product.

Products include Royal-Elementor-Addons Royal Elementor Addons.

How do I fix CVE-2025-26990?

No fix has been published for CVE-2025-26990 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-26990 being exploited?

There is no known exploitation of CVE-2025-26990 in the wild and no public exploit code.

Other vulnerabilities in Royal-Elementor-Addons Royal Elementor Addons

• CVE-2023-5360 Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2024-1567 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload High 8.2
• CVE-2023-5922 Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read High 7.5
• CVE-2024-56226 WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2025-39361 WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability Medium 6.5

All Royal-Elementor-Addons Royal Elementor Addons vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c8fr-pr74-j8mq.