CVE-2026-17565
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.
Risk Assessment
An attacker can use the server as a proxy to attack internal services, potentially leading to exposure of sensitive data or attack escalation.
Recommendation
Update the Animation Addons for Elementor plugin to version 2.7.2 or later to fix the input validation.
Original NVD description (English source)
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.