Arbitrary Location Query Vulnerability in ElementsKit PRO Plugin

CVE-2024-4404

What is CVE-2024-4404?

The ElementsKit PRO plugin for WordPress is affected by a vulnerability that permits Server-Side Request Forgery (SSRF). This issue arises through the 'render_raw' function, which can be exploited by authenticated users with contributor-level access or higher. Attackers can leverage this vulnerability to send requests to arbitrary locations, potentially exposing sensitive data or modifying information from internal services while bypassing security controls.

References