Blind Server-Side Request Forgery in Element Pack Addons for Elementor Plugin
CVE-2025-11536

5MEDIUM

Key Information:

Vendor

WordPress
Status
Element Pack Addons For Elementor
Vendor
CVE Published:
20 October 2025

What is CVE-2025-11536?

The Element Pack Addons for Elementor plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and above to exploit the wp_ajax_import_elementor_template action. This issue enables attackers to execute unauthorized web requests, potentially compromising sensitive internal services by querying or modifying data without proper authentication. It is crucial for users to upgrade to secure versions to mitigate the risks associated with this vulnerability.

Affected Version(s)

Element Pack Addons for Elementor * <= 8.2.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/bdthemes-eleme...

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LionTree
JSON
.