High · published January 28, 2026
🚨 Authenticated users with Author-level access can exploit this SSRF vulnerability in the TableMaster for Elementor plugin, potentially exposing sensitive files like wp-config.php. ⚡ Think of it as an employee at a restaurant who can sneak into the kitchen and access all the confidential recipes, including those that shouldn’t be shared with anyone else! This vulnerability allows an attacker to make web requests to any URL, including internal services, which could lead to exposure of sensitive information or even server compromise. With just a crafted CSV import, an attacker can access files that hold the keys to your WordPress kingdom!
Think of it as an employee at a restaurant who can sneak into the kitchen and access all the confidential recipes, including those that shouldn’t be shared with anyone else! The TableMaster for Elementor plugin fails to restrict the URLs it can fetch when importing CSV data, allowing an attacker with Author-level access to send requests to arbitrary locations.
This vulnerability allows an attacker to make web requests to any URL, including internal services, which could lead to exposure of sensitive information or even server compromise. With just a crafted CSV import, an attacker can access files that hold the keys to your WordPress kingdom! Update the plugin to version 1.3.7 or later to fix this vulnerability. Additionally, review user roles and permissions to minimize the risk of exploitation. Regularly audit your plugins for vulnerabilities! You've got this! Follow these steps, and you'll keep your site secure. 🛡️