CVE-2026-110692: PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Contributor role or any higher-privileged role can exploit it. Exploitation does not require user interaction and can be performed over the network.
What systems or data can an attacker reach through the vulnerability?
The attacker can cause the WordPress server to make HTTP requests to internal and loopback resources. The response from those requests may be readable by the attacker, exposing information available only from the server's network position.
Which plugin versions are affected and what version fixes it?
PowerPack Addons for Elementor versions 2.10.0 through 3.1.2 are affected. Version 3.1.3 is the first version stated as not affected.