Executive Summary
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.7.1064. This vulnerability allows an authenticated attacker with Contributor-level access and above to make web requests to arbitrary locations, potentially querying and modifying information from internal services. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
Technical Analysis
The vulnerability is caused by the Form Builder widget's 'webhook_url' setting, which persists an attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render. The wpr_form_builder_webhook AJAX handler reads this option and dispatches an outbound request via the non-safe wp_remote_post() function, with no host allowlist, scheme restriction, or private/loopback IP filter. This makes it possible for authenticated attackers to make web requests to arbitrary locations originating from the web application.
How It Gets Exploited
An authenticated attacker with Contributor-level access and above can exploit this vulnerability by providing a crafted URL through the Form Builder widget's 'webhook_url' setting. When the wpr_form_builder_webhook AJAX handler is triggered, it will dispatch an outbound request to the attacker-controlled URL, potentially allowing the attacker to query and modify information from internal services. For example, an attacker could use this vulnerability to make requests to internal services, such as databases or APIs, in order to extract sensitive information or perform unauthorized actions.
Impact Assessment
The Royal Elementor Addons plugin for WordPress versions up to and including 1.7.1064 are affected by this vulnerability. An attacker can achieve high impact, including confidentiality, integrity, and availability impacts, with a CVSS score of 8.8. The blast radius of this vulnerability is high, as it allows an attacker to make requests to arbitrary locations, potentially affecting multiple services and systems.
Recommended Actions
To mitigate this vulnerability, it is recommended to update the Royal Elementor Addons plugin to version 1.7.1065 or later. Additionally, users should ensure that only trusted and authenticated users have access to the Form Builder widget, and that the 'webhook_url' setting is properly validated and sanitized. Implementing a Web Application Firewall (WAF) rule to block suspicious requests to internal services may also help to prevent exploitation.