CVE-2026-1641

Name of the Vulnerable Software and Affected Versions Wow Elements Addons for Elementor versions prior to 1.11.3

Description This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated users with Contributor-level access and above can exploit this by providing malicious input through the 'Changelog File' setting, which is passed to the wp remote get() function without proper validation or sanitization of the URL. This allows attackers to make web requests to arbitrary locations from the web application to query or modify information from internal services.

Recommendations Update Wow Elements Addons for Elementor to version 1.11.3 or later.