Royal Addons for Elementor < 1.7.1058 - Contributor+ Server-Side Request Forgery via CSV URL Parameter

Description

The plugin is vulnerable to Server-Side Request Forgery due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers with Contributor-level access and above to make requests to arbitrary URLs and retrieve sensitive information from internal services.