Element Pack Addons CVE-2025-11536

Exploitation requires an authenticated account with Subscriber-level access or above (PR:L) and invocation of the plugin's wp_ajax_import_elementor_template AJAX endpoint; the site must run Element Pack Addons for Elementor version 8.2.5 or earlier. The practical risk is amplified when the WordPress site permits open user self-registration, since that grants any visitor the Subscriber role needed. Limiting factors: it is NOT exploitable by fully unauthenticated attackers, the SSRF is blind (no response body returned to the attacker, constraining data theft), and meaningful impact depends on the presence of reachable internal services (e.g., cloud metadata endpoints, internal APIs) from the web server's network position.

This is a genuine but moderate-priority issue, and the available signals are largely consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0) indicates a network-reachable, low-complexity attack that requires authentication at Subscriber level (PR:L) with no user interaction, and a scope change (S:C) because requests pivot from the web application into internal services. EPSS is low at 0.24% (14th percentile), the vulnerability is NOT listed in CISA KEV, and no public exploit code is indicated - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The main risk driver is the low privilege barrier: WordPress sites frequently allow open/self-service Subscriber registration, which effectively lowers PR:L toward 'any registered user.' The impact ceiling is bounded - this is a blind SSRF (no direct response data returned), so confidentiality impact is limited and there is no direct integrity or availability impact to the host application. Net: a real, patch-worthy flaw useful for internal reconnaissance and reaching metadata/internal endpoints, but not a drop-everything emergency absent exploitation signals. The CVSS vector and the description agree on network vector and authenticated access, so no cross-source contradiction needs vendor verification here.

An attacker registers (or compromises) a low-privilege Subscriber account on a WordPress site running Element Pack Addons for Elementor <= 8.2.5, then invokes the wp_ajax_import_elementor_template AJAX action with an attacker-controlled URL. The server issues an outbound request to that URL, allowing the attacker to probe internal-only services (e.g., cloud metadata endpoints or internal admin panels) from the trusted server context. No public exploit code is identified at time of analysis, and because the SSRF is blind, the attacker infers results from timing/behavioral side effects rather than direct response content.