Description

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-19T06:17:36.230Z",
  "pubdate": "2026-08-19T06:17:36.230Z",
  "executiveSummary": "An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the Animation Addons for Elementor WordPress plugin prior to version 2.7.2. The security flaw stems from the application failing to properly validate or sanitize user-supplied input prior to utilizing it for constructing the host parameter of an outbound server-side HTTP request. As a result, remote unauthenticated malicious actors can leverage the vulnerable WordPress installation as a proxy to issue arbitrary HTTP requests targeting internal infrastructure, private network endpoints, and local loopback addresses that are normally inaccessible from the external public internet. Successful exploitation of this vulnerability allows unauthorized users to read the responses returned by internal hosts, potentially leading to the exposure of sensitive internal data, service enumeration, and further exploitation of internal network resources. The risk implications are severe due to the lack of authentication and privilege requirements, enabling automated and remote exploitation against any exposed WordPress instance running vulnerable versions of the plugin.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient input validation and sanitization within the URL handling logic of the Animation Addons for Elementor plugin. When processing requests, the plugin accepts a user-supplied parameter and dynamically incorporates this value to construct the host component of an outbound server-side HTTP request without enforcing strict allowlists or destination validation. Because the application blindly trusts the input provided by the client, it initiates an HTTP connection to the user-specified host from the context of the underlying hosting server. The attack flow begins when an unauthenticated remote attacker sends a specially crafted HTTP request to the vulnerable WordPress endpoint containing a manipulated value in the parameter responsible for host construction. The vulnerable component parses this input and executes a server-side request pointing to an internal target, such as metadata services, internal microservices, or restricted intranet applications. The server then retrieves the response from the internal host and inadvertently reflects or leaks the content back to the external attacker in the HTTP response. The affected versions comprise all installations of the Animation Addons for Elementor plugin prior to version 2.7.2. The vulnerability requires network exposure via HTTP/HTTPS, can be exploited by unauthenticated remote attackers, and demands no elevated privileges on the target system. Post-exploitation impact includes unauthorized information disclosure regarding internal network topology, access to internal APIs, and potential pivoting into restricted internal zones accessible from the web server."
}