WordPress Plugin Vulnerabilities

Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery

Description

The plugin does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

Proof of Concept

Affects Plugins

Plugin icon
animation-addons-for-elementor
Fixed in 2.7.2

References

CVE
CVE-2026-17565

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Seongwon Lee
Submitter
Seongwon Lee
Verified
Yes
WPVDB ID
e88e0b71-145c-4edd-9b62-783215b64c67

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-19 (about 9 hours ago)

Other

Published
Title
Published
2026-01-13
Title
GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute
Published
2025-01-13
Title
W3 Total Cache < 2.8.2 - Subscriber+ Server-Side Request Forgery
Published
2026-03-20
Title
MimeTypes Link Icons < 3.3.0 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content
Published
2026-04-01
Title
Webmention < 5.7.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2025-02-28
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.7.5 - Unauthenticated Limited Server-Side Request Forgery in nice_links