The Prime Slider – Addons for Elementor plugin allows a Server‑Side Request Forgery that is triggered by the import_elementor_template AJAX action. An authenticated user with subscriber level or higher can cause the web application to send HTTP requests to arbitrary destinations, potentially accessing internal network services and reading or modifying sensitive data. This vulnerability is classified as CWE‑918 and enables indirect external interaction from within the website's context.

The affected product is bdthemes Prime Slider – Addons for Elementor plugin for WordPress, versions up to and including 4.0.9. Protection is required for sites that deploy these versions, especially when subscribers or higher roles are present.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of discovery and exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale active exploitation. Attackers must first authenticate with subscriber or higher privileges and then invoke the import_elementor_template action; the failure to validate the target URL allows them to redirect traffic inside the server’s network, which can lead to data exposure when internal services are queried or modified.