Description

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T15:16:52.953Z",
  "pubdate": "2026-08-18T15:16:52.953Z",
  "executiveSummary": "An unauthenticated Server-Side Request Forgery (SSRF) vulnerability has been identified in the PDF Smart Viewer for Elementor plugin, affecting versions up to and including 1.0.4. This security flaw allows remote, unauthenticated threat actors to induce the vulnerable WordPress server into initiating arbitrary HTTP requests toward internal or external resources.\nThe primary impact of this vulnerability includes potential unauthorized access to internal network services, metadata endpoints, and resources that are typically shielded from the public internet by firewalls or network segmentation. In cloud hosting environments, exploitation could potentially expose sensitive instance metadata.\nThe vulnerability requires no user interaction or prior authentication, significantly lowering the attack barrier for malicious actors scanning for exposed endpoints. Remediation requires updating the affected plugin to a patched version once available or restricting access to vulnerable handlers.",
  "technicalDetails": "The vulnerability resides in the PDF Smart Viewer for Elementor plugin, specifically within components handling PDF retrieval or rendering in versions <= 1.0.4. The root cause stems from improper input validation and lack of sanitization of user-supplied URLs or parameters used to fetch external or internal PDF resources via server-side HTTP requests.\nBecause the affected component fails to implement an adequate URL allowlist or restrict requests to external IPs and internal loopback addresses (127.0.0.1, ::1), an attacker can supply arbitrary URIs to the vulnerable endpoint. When the server processes the request, it executes an outbound connection using its own network stack, reflecting the response or interacting with the targeted service.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies the vulnerable endpoint exposed by the plugin within the WordPress installation. Second, the attacker crafts an HTTP request containing a malicious payload in the target URL parameter, pointing either to an external listener controlled by the attacker for data exfiltration or to internal network services (e.g., http://127.0.0.1:80/ or cloud metadata services). Third, the vulnerable component on the WordPress server processes the unsanitized parameter and initiates a backend request to the specified destination. Finally, the server handles the response, potentially leaking internal data back to the attacker or executing unintended actions on internal systems.\nNetwork exposure is fully remote over HTTP/HTTPS, and exploitation requires zero authentication privileges or prior system access. The attack surface relies entirely on the plugin's insecure handling of server-side requests."
}