Blind Server-Side Request Forgery in Element Pack Addons for Elementor Plugin

CVE-2025-11536

What is CVE-2025-11536?

The Element Pack Addons for Elementor plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and above to exploit the wp_ajax_import_elementor_template action. This issue enables attackers to execute unauthorized web requests, potentially compromising sensitive internal services by querying or modifying data without proper authentication. It is crucial for users to upgrade to secure versions to mitigate the risks associated with this vulnerability.

References