CVE-2026-1641: Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wpremoteget function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wow Elements Addons for Elementor (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.11.2 - Configuration
Harden the 'Changelog File' setting input so it is validated/sanitized before being used to call wp_remote_get (e.g., only allow expected safe URL formats/hosts); this mitigates SSRF caused by passing user-controlled input directly to wp_remote_get.
Wow Elements Addons for Elementor (WordPress plugin) Changelog File = instruction to not provide user-controlled/unsanitized URLs
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the WordPress site with a Contributor role or any higher-privileged role. Unauthenticated visitors cannot exploit it based on the available information.
What access does the attacker gain through exploitation?
The attacker can cause the WordPress application to send requests to arbitrary locations. This may allow them to query or modify information exposed by internal services reachable from the web application.
Which plugin versions are affected?
All versions of Wow Elements Addons for Elementor up to and including 1.11.2 are affected.