Pdf Smart Viewer For Elementor
Monthly
Unauthenticated Server-Side Request Forgery in PDF Smart Viewer for Elementor (WordPress plugin by Deknows, versions up to and including 1.0.4) allows any remote, unauthenticated attacker to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-controlled destinations. With a CVSS scope change (S:C), this vulnerability can be leveraged to probe and interact with internal network services not directly exposed to the internet, including cloud metadata endpoints, internal APIs, and adjacent infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, UI:N, AC:L) makes it trivially scriptable.
Unauthenticated Server-Side Request Forgery in PDF Smart Viewer for Elementor (WordPress plugin by Deknows, versions up to and including 1.0.4) allows any remote, unauthenticated attacker to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-controlled destinations. With a CVSS scope change (S:C), this vulnerability can be leveraged to probe and interact with internal network services not directly exposed to the internet, including cloud metadata endpoints, internal APIs, and adjacent infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, UI:N, AC:L) makes it trivially scriptable.