CVE-2025-11536: Element Pack Elementor Plugin SSRF Vulnerability

CVE-2025-11536 Overview

CVE-2025-11536 is a Blind Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Element Pack Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 8.2.5 and resides in the wp_ajax_import_elementor_template action handler. Authenticated attackers with Subscriber-level access or higher can force the WordPress server to issue HTTP requests to arbitrary destinations. This capability allows attackers to reach internal services, cloud metadata endpoints, and other resources not directly exposed to the internet.

Critical Impact
Authenticated attackers with minimal privileges can pivot through the WordPress server to query and modify internal services reachable from the web application.

Affected Products

Element Pack Addons for Elementor plugin for WordPress
All versions up to and including 8.2.5
WordPress sites where the plugin is installed and activated

Discovery Timeline

2025-10-20 - CVE-2025-11536 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11536

Vulnerability Analysis

The vulnerability exists in the setup wizard component of the Element Pack Addons for Elementor plugin. The wp_ajax_import_elementor_template AJAX action accepts a user-controlled URL parameter and issues an outbound HTTP request without validating the destination. Because the action is registered under wp_ajax_ rather than wp_ajax_nopriv_, any authenticated WordPress user, including a Subscriber, can invoke it. The response body is not returned to the caller, making this a blind SSRF where attackers infer results through side channels such as timing, error responses, or out-of-band interactions.

Root Cause

The plugin fails to enforce two independent controls. First, it lacks a capability check appropriate for a template import operation, so low-privilege roles can trigger the request. Second, it does not validate or restrict the target URL, permitting requests to loopback addresses, private RFC1918 ranges, and cloud provider metadata services such as 169.254.169.254.

Attack Vector

An attacker authenticates to WordPress with any account, including a self-registered Subscriber where open registration is enabled. The attacker then submits a crafted request to the admin-ajax.php endpoint invoking the import_elementor_template action with a URL pointing to an internal target. The WordPress host resolves and connects to the specified URL, potentially reaching internal APIs, databases, or cloud metadata endpoints. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the specific handler implementation.

Detection Methods for CVE-2025-11536

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the action parameter import_elementor_template from low-privilege user sessions.
Outbound HTTP requests from the WordPress host to internal IP ranges such as 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or cloud metadata IP 169.254.169.254.
Unusual spikes in Subscriber-level account creation followed by AJAX activity.

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the vulnerable action parameter combined with a URL argument.
Correlate authenticated low-privilege sessions with outbound network connections initiated by the PHP-FPM or webserver process.
Alert on any egress traffic from web application hosts to link-local or private address ranges that are not part of documented application flows.

Monitoring Recommendations

Enable verbose logging of WordPress AJAX actions and forward logs to a centralized SIEM for correlation.
Instrument egress network policies to log and block requests from web servers to cloud metadata endpoints.
Monitor plugin inventory across WordPress fleets to identify vulnerable installations of Element Pack Addons for Elementor at or below 8.2.5.

How to Mitigate CVE-2025-11536

Immediate Actions Required

Update the Element Pack Addons for Elementor plugin to a version above 8.2.5 as soon as the vendor releases a patched release.
Audit WordPress user accounts and disable open registration unless it is required by the site's business function.
Restrict outbound network access from WordPress hosts to only the destinations required for normal operation.

Patch Information

At the time of NVD publication, the vulnerability affects all versions up to and including 8.2.5. Site operators should consult the Wordfence Vulnerability Analysis for the latest patched version and upgrade guidance from the plugin author.

Workarounds

Deactivate and remove the Element Pack Addons for Elementor plugin until a patched version is available.
Deploy a Web Application Firewall rule to block requests to admin-ajax.php with the action=import_elementor_template parameter from Subscriber-level accounts.
Enforce IMDSv2 on AWS EC2 instances hosting WordPress to require session-based tokens for metadata access.
Apply egress filtering at the host or network layer to deny connections from the web server to 169.254.169.254 and private address ranges.

bash

# Example iptables egress rules to block SSRF pivots from a WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT