CVE-2026-17565: Elementor Animation Addons SSRF Vulnerability

CVE-2026-17565 Overview

CVE-2026-17565 is a Server-Side Request Forgery (SSRF) vulnerability in the Animation Addons for Elementor WordPress plugin versions before 2.7.2. The plugin fails to validate a user-supplied value before using it to build the host of a server-side HTTP request. Unauthenticated attackers can force the site to issue requests to internal hosts and read the responses back. The flaw maps to CWE-918: Server-Side Request Forgery and carries a scope change in its CVSS vector, indicating impact beyond the vulnerable component.

Critical Impact
Unauthenticated attackers can pivot through the WordPress server to reach internal-only services, cloud metadata endpoints, and other assets not exposed to the internet.

Affected Products

Animation Addons for Elementor WordPress plugin versions prior to 2.7.2
WordPress sites running the vulnerable plugin
Environments where the WordPress server has network reachability to internal or cloud metadata services

Discovery Timeline

2026-08-19 - CVE-2026-17565 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-17565

Vulnerability Analysis

The Animation Addons for Elementor plugin accepts a user-supplied value and incorporates it into the host portion of an outbound HTTP request. The plugin does not validate or restrict this value against an allowlist of permitted destinations. As a result, an unauthenticated attacker can direct the WordPress backend to issue requests toward arbitrary hosts, including internal RFC 1918 addresses, loopback interfaces, and cloud instance metadata endpoints such as 169.254.169.254. The response is returned to the attacker, enabling information disclosure of internal service banners, configuration data, or short-lived cloud credentials.

Root Cause

The root cause is missing input validation on a host parameter used to construct a server-side HTTP request. The plugin trusts attacker-controlled input to define the destination of an outbound network call, without enforcing scheme, host, or IP-range restrictions. This is a canonical instance of CWE-918.

Attack Vector

Exploitation requires only network access to the target WordPress site. No authentication and no user interaction are needed. An attacker submits a crafted request to the vulnerable plugin endpoint with a host value pointing at an internal resource. The WordPress server issues the request on the attacker's behalf and returns the response body, allowing enumeration of internal HTTP services, database admin panels, orchestration APIs, or cloud metadata services. Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-17565

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP process to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 127.0.0.0/8
Requests originating from the WordPress host targeting cloud metadata endpoints, notably 169.254.169.254 on AWS, Azure, and GCP
Unusual PHP-initiated connections to non-standard internal ports associated with databases, caches, or admin consoles

Detection Strategies

Inventory WordPress installations and identify any running Animation Addons for Elementor at a version below 2.7.2
Inspect web server access logs for anonymous requests to plugin endpoints containing URL, host, or domain parameters
Correlate PHP-FPM or Apache worker process network activity with destinations outside expected upstream services

Monitoring Recommendations

Enable egress logging on web servers and alert on connections from the web tier to RFC 1918 space or link-local metadata addresses
Deploy Web Application Firewall (WAF) rules that inspect query parameters for embedded internal IPs and hostnames
Enforce Instance Metadata Service Version 2 (IMDSv2) on cloud workloads to require session tokens for metadata access

How to Mitigate CVE-2026-17565

Immediate Actions Required

Upgrade Animation Addons for Elementor to version 2.7.2 or later on all affected WordPress sites
Audit web server egress logs for evidence of SSRF probing against internal ranges and metadata endpoints
Rotate any cloud instance credentials that could have been retrieved via the metadata service on affected hosts

Patch Information

The vendor addressed the vulnerability in Animation Addons for Elementor version 2.7.2. Site administrators should update through the WordPress plugin dashboard or via WP-CLI. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the Animation Addons for Elementor plugin until the upgrade to 2.7.2 can be completed
Restrict egress from the WordPress server to only required destinations using host-based firewall or security group rules
Block access to 169.254.169.254 from application containers and require IMDSv2 on cloud instances
Deploy WAF rules that reject requests containing internal IP addresses or private hostnames in user-controllable parameters

bash

# Update the plugin using WP-CLI
wp plugin update animation-addons-for-elementor --version=2.7.2

# Verify installed version
wp plugin get animation-addons-for-elementor --field=version