CVE-2026-17123

The Royal Elementor Addons plugin for WordPress has a vulnerability in its Form Builder widget that allows attackers to make unauthorized web requests to arbitrary locations. This is due to the plugin's failure to properly validate and restrict the URLs used in the webhook setting, allowing an attacker to inject a malicious URL that is then executed by the plugin's AJAX handler. As a result, an authenticated attacker with Contributor-level access can make requests to internal services, potentially allowing them to access or modify sensitive information.

Based on public CVE data (MITRE/NVD).