CVE-2026-1641

Received Received - Intake

Server-Side Request Forgery in Wow Elements Addons for Elementor

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-1641

Affected Vendors & Products

Vendor	Product	Version / Range
wow_elements	addons_for_elementor	to 1.11.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

The Wow Elements Addons for Elementor plugin for WordPress has a Server-Side Request Forgery (SSRF) vulnerability in versions up to 1.11.2. This flaw allows authenticated attackers with Contributor-level access or higher to manipulate the 'Changelog File' setting to send web requests to arbitrary internal or external locations via the wp_remote_get function. The plugin fails to properly validate or sanitize user-controlled input, enabling these unauthorized requests.

Impact Analysis

This vulnerability could allow attackers to access internal services, exfiltrate sensitive data, or interact with other systems on your network. If exploited, it may lead to unauthorized information disclosure, modification of internal resources, or potential further attacks against your WordPress environment or connected systems.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized access to internal services could lead to breaches of confidentiality, integrity, or availability of regulated data.

Mitigation Strategies

Update the Wow Elements Addons for Elementor plugin to the latest version beyond 1.11.2. If an update is not available, consider disabling or removing the plugin immediately. Restrict user roles to the principle of least privilege, ensuring only necessary users have Contributor-level access or higher.

Hi! I’m here to help you understand CVE-2026-1641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70