The TableMaster for Elementor plugin for WordPress suffers from an SSRF vulnerability (CWE-918) in all versions up to 1.3.6. The issue stems from insufficient validation of URLs used in the CSV import feature of the Data Table widget. Authenticated users with Author-level privileges or higher can exploit this flaw by supplying a crafted 'csv_url' parameter, enabling them to make server-side HTTP requests to arbitrary locations, including internal network endpoints and local files like wp-config.php. This can lead to unauthorized information disclosure. The vulnerability is publicly known and assigned CVE-2025-14610 with a CVSS v3.1 base score of 7.2 (high). There is no vendor advisory or patch information available at this time.

An attacker with Author-level access or higher can exploit this SSRF vulnerability to make arbitrary HTTP requests from the server hosting the WordPress site. This includes accessing internal network resources and reading sensitive files such as wp-config.php, potentially exposing database credentials and other confidential information. The vulnerability does not directly allow remote code execution or denial of service but can lead to significant information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level and higher user permissions to trusted users only. Consider disabling the CSV import feature or restricting its use. Monitor for updates from the plugin vendor and apply patches promptly once available.