WordPress Plugin Vulnerabilities

PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import

Description

The plugin does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.

Proof of Concept

Affects Plugins

Plugin icon
powerpack-lite-for-elementor
Fixed in 3.1.3

References

CVE
CVE-2026-110692

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Min Seok Kim
Submitter
Min Seok Kim
Verified
Yes
WPVDB ID
ac6405e6-9a1e-4ad6-bfd7-e672030a31c1

Timeline

Publicly Published
2026-11-02 (about 2 days ago)
Added
2026-11-02 (about 1 day ago)
Last Updated
2026-11-02 (about 1 day ago)

Other

Published
Title
Published
2025-04-09
Title
PowerPress Podcasting < 11.12.7 - Contributor+ SSRF
Published
2022-04-11
Title
HubSpot < 8.8.15 - Contributor+ Blind SSRF
Published
2025-05-07
Title
WP Pipes <= 1.4.3 - Authenticated (Administrator+) Server-Side Request Forgery
Published
2025-03-19
Title
Order Export & Order Import for WooCommerce < 2.6.1 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Published
2025-01-03
Title
Envato Elements < 2.0.15 - Author+ Server-Side Request Forgery