PT-2026-50845 · WordPress · Royal Elementor Addons
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
The Royal Addons for Elementor – Addons and Templates Kit for Elementor versions 1.7.1058 through 1.7.1059
Description
An arbitrary file read issue exists due to the
wpr get csv handle() helper function. When the settings.table upload csv.url variable does not parse as an HTTP URL, the function falls back to using is readable() and fopen($source, 'r') without an allow-list, traversal block, or extension check. Authenticated attackers with Contributor-level access or higher can exploit this by saving a crafted wpr-data-table widget via the 'save builder' endpoint, allowing the rendered preview to return the contents of any file readable by the PHP process, such as wp-config.php.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Royal Elementor Addons