CVE-2026-17565: Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery

Q: Who can exploit this issue?

The issue can be exploited by unauthenticated users; no login or WordPress account is required.

Q: What access does an attacker gain through the vulnerable site?

An attacker can cause the site to send server-side HTTP requests to internal hosts and can read the responses returned by those requests.

Q: Which installations are affected?

Animation Addons for Elementor versions earlier than 2.7.2 are affected. The provided information does not identify any configuration requirement.

Published Aug 19, 2026

Updated

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

Affected Software

1 affected component

Animation Addons for Elementor<2.7.2

Event History

Aug 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue can be exploited by unauthenticated users; no login or WordPress account is required.

What access does an attacker gain through the vulnerable site?

An attacker can cause the site to send server-side HTTP requests to internal hosts and can read the responses returned by those requests.

Which installations are affected?

Animation Addons for Elementor versions earlier than 2.7.2 are affected. The provided information does not identify any configuration requirement.