EUVD-2026-83550
GHSA-mw9j-687w-wh97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account on target WordPress site
-
DeliveryInsert Wow Elements Changelog widget
-
ExploitSet 'Changelog File' URL to internal target
-
ExecutionServer issues wp_remote_get to attacker URL
-
ImpactReach internal/cloud-metadata services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with Contributor-level capability or higher (per the Wordfence description), plus the ability to add/configure the Wow Elements 'Changelog' widget and set its 'Changelog File' URL setting. The plugin (all versions up to and including 1.11.2) must be installed and active. The limiting factor is the Contributor authentication barrier - this is NOT unauthenticated despite the PR:N in the supplied CVSS vector. Impact is bounded to whatever internal services are network-reachable from the web server (e.g., cloud metadata endpoints, internal APIs); whether response data is returned to the attacker depends on how the widget renders the fetched content. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), and CWE-918 (SSRF) is credible given the code path: the 'Changelog File' widget setting is passed straight into wp_remote_get() without URL validation (trac changelog.php#L786). CRITICAL CONFLICT: the CVSS vector encodes PR:N (unauthenticated), but the Wordfence description explicitly states exploitation requires 'Contributor-level access and above' - these disagree, and the description should be treated as authoritative (this is authenticated, PR:L). This materially lowers real-world risk versus what the PR:N vector implies, since an attacker must already hold a Contributor account. No EPSS score, KEV listing, POC, or SSVC data was supplied; absent those, there is no evidence of active exploitation or automatable mass-exploitation. Net: a real internal-network pivot primitive worth patching, but gated behind authenticated access and not an emergency compared to unauthenticated SSRF. |
| Exploit ScenarioDerived | An attacker who has obtained (or registered) a Contributor-level WordPress account edits a page/post containing the Wow Elements Changelog widget and sets the 'Changelog File' URL to an internal target such as http://169.254.169.254/ or an internal admin service. When the widget renders, the server performs wp_remote_get() to that URL, letting the attacker reach cloud metadata endpoints or internal services otherwise unreachable from outside. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Server-side request forgery in the Wow Elements Addons for Elementor WordPress plugin (all versions up to and including 1.11.2) lets an authenticated attacker with Contributor-level access or higher coerce the site's web server into issuing HTTP requests to arbitrary attacker-chosen destinations. The flaw is in the plugin's Changelog widget, which passes the user-controlled 'Changelog File' setting directly into wp_remote_get() with no URL validation or sanitisation, allowing requests to be aimed at internal-only resources such as cloud metadata endpoints or intranet APIs. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the Contributor authentication prerequisite and the bounded, low-level confidentiality/integrity/availability impact keep this a genuine but moderate-priority issue rather than an emergency patch item.
RemediationAI
Upstream fix available (changeset committed to the plugin's Trac repository); a released patched version is not independently confirmed in the provided data, so administrators should update Wow Elements Addons for Elementor to the newest available release and verify that the Changelog widget no longer forwards the 'Changelog File' setting unsanitised to wp_remote_get() (compare against the trunk source at includes/widgets/changelog.php and changeset 3583568). Until a fixed build is running, the most effective compensating control is to deactivate or uninstall the plugin where the Changelog widget is not needed, eliminating the vulnerable sink entirely; a narrower alternative is to remove/disable only the Changelog widget for all roles, accepting the loss of that functionality. Because exploitation requires a Contributor-or-higher account, tightening role assignments (auditing and downgrading accounts that do not genuinely need Contributor capabilities, especially on multi-author sites) raises the bar but is not a fix on its own and may disrupt legitimate publishing workflows. Network-layer egress filtering from the WordPress host - blocking link-local 169.254.0.0/16 (cloud instance metadata), loopback, and unneeded internal RFC1918 ranges - neutralises the most valuable SSRF targets, though it can break legitimate integrations and should not be the only mitigation; enforcing IMDSv2 on AWS or equivalent metadata hardening on other cloud providers specifically limits credential theft via metadata endpoints. Outbound request filtering/WAF rules that reject requests originating from the widget with non-http(s) or internal-IP targets add defence in depth but can be bypassed via DNS rebinding or redirects. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8ded7bd6-3dd8-4659-9704-f197e7c2f941?source=cve for the latest vendor-verified fix guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-918 (Server-Side Request Forgery): user-controlled input is supplied as the URL argument to WordPress's wp_remote_get() HTTP API without an allowlist, scheme restriction, or internal-address filtering. The vulnerable sink is in the plugin's Changelog widget implementation, referenced at includes/widgets/changelog.php line 786 in both current trunk and the older 1.5.6 tag, indicating the unsafe pattern has existed in the codebase for many releases rather than being a recent regression. In WordPress, a Contributor can create and edit their own posts and can add widgets/block content subject to the site's configuration, so the attacker-supplied 'Changelog File' value is stored with the widget and later rendered server-side; the server then performs the outbound fetch. Because the request originates from the WordPress host, it can potentially reach services that are not exposed to the internet, including link-local metadata endpoints (for example 169.254.169.254) and internal-only APIs. Whether data is returned to the attacker is not guaranteed and depends on how the widget renders the fetched response - if the fetched body is echoed into the page, the SSRF becomes a read primitive; if not, the attacker may still be able to infer internal state via blind timing or error behaviour. The affected product is identified by CPE cpe:2.3:a:wowelements:wow_elements_addons_for_elementor:*:*:*:*:*:*:*:*, i.e. the whole version line of the WordPress plugin.
Know when Wow Elements Addons For Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
PR:L because the description requires Contributor-level authentication (not PR:N as in the input vector); C:L added since SSRF can query internal services, matching the description's 'query and modify' language.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB