Security Alert Summary
The Animation Addons for Elementor WordPress plugin before 2.7.2 contains a server-side request forgery (SSRF) issue. The plugin does not validate a user-supplied value before using it to build the host of a server-side HTTP request, which can allow unauthenticated users to make the site issue requests to internal hosts and read the responses.
CVE Details
- CVE ID: CVE-2026-17565
- Affected component: Animation Addons for Elementor WordPress plugin
- Affected versions: Versions before 2.7.2 (as stated in the advisory)
- Published: August 19, 2026 at 6:17:36 AM
- Last modified: August 19, 2026 at 6:17:36 AM
- CVSS v3.1 base score / severity / vector: Not provided in the CVE data
- Authentication / Privileges / User interaction: Not specified in the CVE data; the description indicates the issue can be triggered by unauthenticated users
- Primary impact:
- Confidentiality: Possible disclosure of internal network responses and resources reachable from the web server.
- Integrity: Not indicated by the provided data.
- Availability: Not indicated by the provided data.
- CWE / Weakness ID: Not specified in the CVE data
Technical Details
The vulnerability is a server-side request forgery (SSRF) caused by insufficient validation of a user-supplied value that is used to construct the host for a server-side HTTP request. Because the plugin uses this value directly when building the request target, an attacker who can supply that value may cause the site to perform HTTP requests to arbitrary hosts reachable from the web server, including internal services. The attacker can also read the responses returned by those requests according to the CVE description.
The CVE description does not name specific PHP functions, REST endpoints, or code locations. It reports the root cause as missing validation of the user-supplied host value. The practical impact is limited to the ability to make the server issue requests and retrieve responses; it does not by itself describe remote code execution or direct administrative access.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner, internal staff who manage content, and an external contractor or contributor who has limited access. An unauthenticated attacker could exploit this flaw to make your site send HTTP requests to internal services that are otherwise not exposed to the Internet (for example, internal APIs, metadata endpoints on some hosting providers, or admin-only interfaces). The attacker could read responses that may contain sensitive information such as internal service data or configuration snippets.
Practical consequences include exposure of internal endpoints and data that could be used to craft targeted phishing or social engineering campaigns against staff or contractors. While the vulnerability description does not indicate full site compromise, the disclosure of internal responses can increase the risk profile for your organization.
If you re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or lower accounts that can submit content or inputs processed by plugins.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual outbound requests and unexpected behavior related to plugin endpoints.
If you d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
