The vulnerability is a Server‑Side Request Forgery flaw that allows an attacker to send arbitrary HTTP requests from the target server. The weakness can be leveraged to access internal resources, exfiltrate data, or interact with services that the server has connectivity to. The attack capitalizes on the plugin’s handling of user‑supplied URLs without proper validation, classified under CWE‑918.

The affected product is the ElementsCSS Addons for Elementor plugin from TheInnovs, version 1.0.8.9 and earlier. WordPress installations hosting this plugin are at risk unless the plugin is upgraded to a post‑1.0.8.9 release or removed.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of <1% suggests the likelihood of exploitation is currently very low, and the vulnerability is not listed in CISA’s KEV catalog. However, the potential impact of SSRF—particularly if the target server can reach internal or privileged services—warrants prompt remediation. Attackers would need to craft a request to the vulnerable endpoint; no special privileges or authentication are required because the plugin typically processes user inputs from public or logged‑in sources.