CVE-2024-32718 MEDIUM

CVE-2024-32718: WordPress The Pack Elementor addons plugin <= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerability

Vendor Webangon
Product The Pack Elementor addons
Weakness CWE-918 · SSRF
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Webangon The Pack Elementor.This issue affects The Pack Elementor addons: from n/a through 2.0.8.2.

Explanation of Vulnerability in Simple Terms

02Summary

The Pack Elementor addons through version 2.0.8.2 contain a server-side request forgery vulnerability. An authenticated user with low privileges can make the site send HTTP requests to internal or external systems on the attacker's behalf. The impact is limited to reading non-sensitive data and modifying some content, but the scope extends beyond the plugin itself.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external servers to read data or perform actions.

Potential impact on your site

04Site Impact

Authenticated users can probe your internal network, access private APIs, or trigger actions on external services.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site; no user interaction required.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6514 InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter CVE-2026-4979 UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter CVE-2026-11370 WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter CVE-2026-7798 FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter CVE-2026-39645 WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability