The vulnerability exists because the Animation Addons for Elementor plugin does not validate a user‑supplied host before constructing an HTTP request. This omission allows any unauthenticated web user to supply a target host, causing the site to perform an outbound request and return the response content. The result is an SSRF that can read internal network resources and exfiltrate data without authentication.

Affected systems are WordPress sites running the Animation Addons for Elementor plugin older than version 2.7.2. The vulnerability is present in all builds prior to that release, including v2.7.1 and earlier.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.2 indicates high severity. Based on the EPSS score, it is inferred that exploitation is currently rare or not widely observed. Still, the likely attack vector is the plugin’s endpoint that accepts an unvalidated host parameter, allowing an attacker to craft a request with a chosen host and trigger the site to make that request. Once executed, the plugin surfaces the response payload back to the attacker. Because the request originates from the site’s server, internal IP addresses, privileged APIs, or non‑reachable domains can be accessed. The lack of validation also permits DNS rebinding or proxy discovery. Consequently, the potential impact is high if sensitive internal resources are reachable, although the inferred low EPSS suggests that many deployment environments may not create immediate risk.