CVE-2026-110692 · Package
NO FIX YET · SEE WHAT TO DO
The PowerPack Addons for Elementor WordPress plugin before 3.1.3 does not validate a user-supplied URL before the server requests it. A contributor-level WordPress user can make the server fetch internal or loopback addresses and read the responses back.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the PowerPack Addons for Elementor plugin before 3.1.3 that have users with the contributor role or higher. The exposure comes from the plugin's server-side URL request, so sites without the plugin or without contributor-level accounts can skip it. Sites that limit who can create content are less exposed.
Not affected if no-contributor-accounts, plugin-3.1.3-or-later, plugin-not-installed
Who cares elementor, powerpack-addons, self-hosted, wordpress
wp plugin get powerpack-elements --field=version3.1.3 or laterThe PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.