The vulnerability allows an attacker to induce the plugin to make arbitrary HTTP requests from the server, potentially exposing sensitive internal resources or facilitating further attacks. This SSRF flaw can lead to data disclosure, credential harvesting, or pivoting to other systems, depending on the target URL chosen by the attacker. The weakness is classified as CWE‑918, indicating uncontrolled remote request execution.

WordPress sites running Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin that are at version 2.0.19 or earlier are affected. The plugin name is Unlimited Elements and the problematic releases end at 2.0.19.

With a CVSS score of 6.4 the risk is moderate but not trivial; the EPSS score is not available, so no visibility into current exploitation prevalence, and it is not listed in CISA’s KEV catalog. The likely attack vector involves submitting a crafted request to a vulnerable function within the plugin, which then performs the external call. This can be attempted over the public web interface, implying that remote attackers could exploit the flaw without authentication, though the exact prerequisites are not detailed in the description.