EUVD-2026-93243
GHSA-65jr-3c3h-9h5p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin endpoint unauthenticated
-
DeliverySubmit attacker-controlled URL parameter
-
ExploitServer fetches internal resource (SSRF)
-
ExecutionPivot to internal/metadata services
-
ImpactExfiltrate limited response data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component is the PDF Smart Viewer for Elementor WordPress plugin at versions 1.0.4 and earlier; exploitation requires only network access to a WordPress site running this plugin, with no authentication (PR:N) and no user interaction (UI:N) per the CVSS vector. The core prerequisite is that the vulnerable plugin is installed and active and its PDF-fetching/viewer functionality is reachable, as SSRF requires the plugin to accept and act on an attacker-supplied URL or resource reference. Limiting factors: impact is bounded (C:L/I:L/A:N) and real-world exposure depends on the plugin being installed (a low-prevalence add-on) and on sites not already updated to a fixed release; the specific vulnerable parameter/endpoint is not detailed in the provided data. |
| Impact | Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which inflates the 7.2 base score largely via the scope change (S:C) and dual low-impact confidentiality/integrity (C:L/I:L, A:N) typical of SSRF (CWE-918). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is best characterized as a genuine unauthenticated SSRF but against a low-footprint WordPress plugin, so this is a moderate-priority, patch-in-normal-cycle issue rather than an emergency - the high-ish CVSS is driven by the scope/impact math, not by demonstrated real-world exploitation. Missing data to note explicitly: no vendor advisory beyond the Patchstack reference, no confirmed fixed version, and no EPSS/KEV/POC signals to corroborate or downgrade the CVSS-implied exposure. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to the vulnerable PDF Smart Viewer for Elementor endpoint, coercing the WordPress server to make attacker-controlled outbound requests. This can be abused to probe internal network services or reach cloud instance metadata endpoints, with responses partially disclosed back (C:L) given the low-complexity, no-interaction vector. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated server-side request forgery in the WordPress plugin PDF Smart Viewer for Elementor (versions 1.0.4 and earlier) lets any remote attacker induce the affected site's server to fetch an arbitrary URL of the attacker's choosing, with no authentication (PR:N) and no user interaction (UI:N) required per the assessed CVSS vector. Because the scope is changed (S:C) but confidentiality and integrity impacts are bounded (C:L/I:L), a successful attack typically means using the WordPress host as a request proxy to probe or interact with internal-only services, loopback interfaces, or cloud instance metadata endpoints rather than direct compromise of the plugin itself. Only sites with the plugin installed and active, and whose PDF-fetching functionality is reachable, are exposed; no public exploit code was identified at time of analysis, and exploitation is not confirmed as active in the wild.
RemediationAI
No vendor-released patch version is identified in the available data; the affected range is stated as versions up to and including 1.0.4, so site operators should check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pdf-smart-viewer-for-elementor/vulnerability/wordpress-pdf-smart-viewer-for-elementor-plugin-1-0-4-server-side-request-forgery-ssrf-vulnerability-2?_s_id=cve and the WordPress plugin directory for a release above 1.0.4 and upgrade to it as soon as one is published via the WordPress admin updates screen or WP-CLI (wp plugin update pdf-smart-viewer-for-elementor). While no fix is available, the most direct mitigation is to deactivate and remove the plugin if its PDF viewing feature is not business-critical, which fully eliminates the exposure but removes the functionality. If the plugin must stay active, constrain the blast radius of any SSRF: apply an egress firewall or proxy rule on the web server that blocks outbound requests to RFC1918 private ranges, loopback, and link-local/cloud metadata addresses such as 169.254.169.254, accepting that this can break legitimate PDF fetching from internal hosts; enforce IMDSv2 on AWS instances so metadata tokens cannot be retrieved by a simple GET; and restrict access to the plugin's endpoints with a WAF rule that rejects requests carrying URL-like parameters pointing at internal address space, understanding that WAF bypasses via encodings and redirects are common. Monitoring outbound HTTP from the web server for unexpected destinations, and reviewing server logs for requests to loopback or metadata IPs, provides detection coverage in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-918 (Server-Side Request Forgery): the plugin accepts a user- or request-supplied URL or resource reference when retrieving a PDF for display and performs that outbound request server-side without validating or restricting the destination, so the attacker controls where the WordPress server connects. The CPE cpe:2.3:a:deknows:pdf_smart_viewer_for_elementor confirms the affected component is the Elementor PDF viewer plugin published under the 'deknows' vendor namespace, with the wildcard version indicating all releases through the stated ceiling of 1.0.4. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates the vulnerable path is reachable over the network with low attack complexity, needs no credentials or victim interaction, and crosses a security scope boundary - the classic SSRF pattern where the attacker's reach is measured not against the plugin but against the broader network the web server can see. SSRF in a WordPress context is particularly relevant because the web server frequently sits behind a reverse proxy or in a cloud VPC with access to internal admin panels, caching layers, and metadata services (for example, link-local cloud metadata) that are not otherwise reachable from the internet; the limited C:L/I:L ratings reflect that the immediate impact is information disclosure and limited request manipulation rather than arbitrary code execution. The exact vulnerable parameter or REST/AJAX endpoint is not detailed in the provided data, but the plugin's PDF-viewing functionality is the presumed entry point since that is where remote resource fetching occurs.
Know when Pdf Smart Viewer For Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote SSRF (PR:N/AV:N/AC:L) crosses a trust boundary to internal systems (S:C) with limited disclosure and request-forgery impact (C:L/I:L), no availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
Executive ViewAI
PDF Smart Viewer for Elementor, versions 1.0.4 and earlier, exposes affected WordPress sites to unauthenticated server-side request forgery, letting attackers use the site's server to fetch arbitrary URLs and interact with internal-only services, loopback interfaces, or cloud instance metadata. Leadership should care because this can turn the WordPress host into a proxy for probing internal networks and cloud metadata, potentially exposing sensitive internal resources, while there is no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing PDF Smart Viewer for Elementor versions 1.0.4 and earlier, blocking WordPress server egress to internal-only services, loopback interfaces, and cloud instance metadata endpoints, restricting outbound traffic to approved destinations, deploying WAF virtual patching if available, and monitoring outbound requests for signs of SSRF abuse.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB