wproyal Royal Addons Plugin up to 1.7.1064 on WordPress Form Builder Widget wp_remote_post webhook_url server-side request forgery

Summaryinfo

A vulnerability, which was classified as critical, was found in wproyal Royal Addons Plugin up to 1.7.1064. This impacts the function wp_remote_post of the component Form Builder Widget. The manipulation of the argument webhook_url results in server-side request forgery. This vulnerability is reported as CVE-2026-17123. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in wproyal Royal Addons Plugin up to 1.7.1064. It has been classified as critical. Affected is the function wp_remote_post of the component Form Builder Widget. The manipulation of the argument webhook_url with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render (including a Contributor previewing their own draft), and the wpr_form_builder_webhook AJAX handler — registered for both authenticated and unauthenticated callers — reads that option and dispatches the outbound request via the non-safe wp_remote_post(), with no host allowlist, no scheme restriction, and no private/loopback IP filter (the plugin's existing wpr_is_blocked_remote_host / wpr_is_private_or_local_ip helpers are not called on this path). This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-17123 since 07/24/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wproyal

Name

• Royal Addons Plugin

Version

• 1.7.1064

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion