The Element Pack Addons for Elementor plugin contains a blind server‑side request forgery flaw that allows authenticated users with Subscriber level or higher to direct the application to make HTTP requests to arbitrary hosts. Because the requests are made from the web server’s environment, the attacker can interact with internal networks that are otherwise inaccessible from the outside. The flaw can lead to data leaks, unauthorized changes to internal services, or further exploitation such as privilege escalation. The weakness is classified as CWE‑918.

bdthemes Element Pack – Widgets, Templates & Addons for Elementor, versions up to 8.2.5

The CVSS score of 5 indicates moderate potential for impact, while an EPSS score under 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must already be authenticated as a Subscriber or higher in the WordPress site and then invoke the import template action to send forged requests from the host.