Description

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-19T08:16:53.330Z",
  "pubdate": "2026-09-19T08:16:53.330Z",
  "executiveSummary": "The Wow Elements Addons for Elementor plugin is susceptible to Server-Side Request Forgery (SSRF) vulnerabilities affecting all versions up to and including 1.11.2.\nThe vulnerability arises from insufficient input validation of the 'Changelog File' setting, which is passed directly to internal WordPress request functions.\nAn authenticated attacker with Contributor-level privileges or higher can leverage this flaw to force the web server to execute arbitrary HTTP requests to external or internal resources.\nThis impact extends to the potential for reconnaissance of internal network infrastructure, bypassing perimeter firewalls, and interacting with services accessible to the server that are not exposed to the public internet.\nExploitation requires active authentication with at least Contributor permissions, making this a significant risk in multi-user WordPress environments where users with low-level administrative capabilities are present.\nThe vulnerability poses a severe threat to the integrity and confidentiality of internal service configurations and sensitive data residing on the same network segment as the affected host.",
  "technicalDetails": "The vulnerability is fundamentally rooted in the insecure handling of user-supplied input within the 'Changelog File' plugin configuration parameter. The application fails to implement a whitelist or robust URI validation mechanism before processing the user-controlled string.\nThe core issue exists because the plugin directly passes the unsanitized input to the wp_remote_get function. This function is a core WordPress API wrapper for the HTTP request library, intended for fetching remote content. By manipulating the 'Changelog File' setting, an attacker can influence the destination URL argument of the function.\nThe attack flow proceeds as follows: First, an authenticated user with Contributor-level access navigates to the plugin settings interface. Second, the user modifies the 'Changelog File' value to point to an arbitrary URI, such as an internal IP address (e.g., 127.0.0.1 or 192.168.x.x) or a sensitive cloud metadata endpoint (e.g., http://169.254.169.254/). Third, upon saving or triggering the plugin function that utilizes this setting, the server initiates an outbound request from the web server's context to the specified destination.\nBecause the server originates the request, it can interact with internal services that are typically unreachable from the outside. This allows the attacker to probe for open ports, perform banner grabbing, or interact with web-based internal administration interfaces. Furthermore, if the server possesses an assigned IAM role or service identity, the SSRF can be leveraged to query internal metadata services to potentially extract temporary credentials.\nThe vulnerable component is the configuration handler responsible for fetching or validating the changelog URL. Since the application fails to perform protocol verification (e.g., restricting requests to only HTTP/HTTPS) or domain restriction (disallowing local or private IP ranges), the impact is extensive. Post-exploitation allows the attacker to map the internal network topology, identify running services, and potentially exploit secondary vulnerabilities in internal components that rely on the assumption of network-level security via perimeter firewalls."
}