{"id":"CVE-2026-110692","kind":"vulnerability","aliases":["CVE-2026-110692"],"related":[],"title":"PowerPack Addons for Elementor: contributors can read internal server responses via SSRF","description":"The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.","summary":"The PowerPack Addons for Elementor WordPress plugin before 3.1.3 does not validate a user-supplied URL before the server requests it. A contributor-level WordPress user can make the server fetch internal or loopback addresses and read the responses back.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","powerpack-addons","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-3.1.3-or-later","plugin-not-installed"],"how_to_check":"- Check the installed PowerPack Addons for Elementor version in the WordPress plugins screen or with `wp plugin get powerpack-elements --field=version`","fix":"- PowerPack Addons for Elementor: `3.1.3` or later","status":"open","published_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:26:27+00:00","updated_at":"2026-11-04T06:26:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:27Z","model":"claude-haiku-5-5","output":{"fix":"- PowerPack Addons for Elementor: `3.1.3` or later","reach":"internet","title":"PowerPack Addons for Elementor: contributors can read internal server responses via SSRF","impact":"medium","summary":"The PowerPack Addons for Elementor WordPress plugin before 3.1.3 does not validate a user-supplied URL before the server requests it. A contributor-level WordPress user can make the server fetch internal or loopback addresses and read the responses back.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","powerpack-addons","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"internal services reachable and their responses readable by a contributor","analyst_note":"","how_to_check":"- Check the installed PowerPack Addons for Elementor version in the WordPress plugins screen or with `wp plugin get powerpack-elements --field=version`\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-3.1.3-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the PowerPack Addons for Elementor plugin before 3.1.3 that have users with the contributor role or higher. The exposure comes from the plugin's server-side URL request, so sites without the plugin or without contributor-level accounts can skip it. Sites that limit who can create content are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4142,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110692':15A,18A '-2026':14A,17A '3.1.3':36B,83C 'addon':2A,23B,30B,72C 'address':64B 'allow':104C 'attack':119C 'back':69B,129C 'contributor':5A,52B,108C 'contributor-level':51B 'could':103C 'cve':13A,16A 'elementor':4A,19B,32B,74C 'fetch':60B 'forgeri':118C 'form':76C 'host':26B 'http':100C 'intern':8A,61B,121C 'level':53B 'loopback':63B,123C 'make':57B 'packag':20B 'perform':113C 'plugin':34B,81C 'powerpack':1A,22B,29B,71C 'powerpack-addon':21B 'read':7A,66B,126C 'request':48B,101C,117C 'resourc':124C 'respons':10A,68B,128C 'role':109C 'self':25B 'self-host':24B 'server':9A,47B,59B,98C,115C 'server-sid':97C,114C 'side':99C,116C 'ssrf':12A 'styler':77C 'suppli':43B,90C 'templat':79C 'url':44B,91C 'use':93C 'user':42B,55B,89C,105C 'user-suppli':41B,88C 'valid':39B,86C 'via':11A 'widget':75C 'wordpress':27B,33B,54B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PowerPack Addons for Elementor plugin before 3.1.3 that have users with the contributor role or higher. The exposure comes from the plugin's server-side URL request, so sites without the plugin or without contributor-level accounts can skip it. Sites that limit who can create content are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elementor","medium","package","powerpackaddons","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110692","severity":null,"published_at":"2026-11-04T06:16:58+00:00","modified_at":"2026-11-04T06:16:58+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}