PT-2026-136851

CVE-2026-110692

·

Published

2026-11-04

·

Updated

2026-11-04

Description by

CVSS 3.1
4.1
Medium
MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-918: Server-Side Request Forgery (SSRF)
Related identifiers
CVE-2026-110692
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com