CVE-2024-1467: CWE-918 Server-Side Request Forgery (SSRF) in brainstormforce Starter Templates – AI-Powered Templates for Elementor & Gutenberg
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
AI Analysis
Technical Summary
The Starter Templates – AI-Powered Templates for Elementor & Gutenberg WordPress plugin contains an SSRF vulnerability (CWE-918) in the ai_api_request() function. This flaw allows authenticated users with contributor-level privileges or higher to cause the server to make arbitrary HTTP requests to internal or external systems. The vulnerability affects all versions up to 4.1.6. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the low complexity and required privileges but limited impact on confidentiality and no impact on availability. No patch or official fix has been documented in the provided data.
Potential Impact
An authenticated attacker with contributor-level access can exploit this SSRF vulnerability to make arbitrary HTTP requests from the server hosting the WordPress plugin. This may enable the attacker to access or modify information on internal services that are otherwise inaccessible externally. The vulnerability does not directly impact confidentiality but can lead to information modification. There is no indication of impact on availability or known exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the ai_api_request() function. Avoid exposing internal services that could be targeted via SSRF. Follow vendor updates closely for any released patches or official mitigations.
CVE-2024-1467: CWE-918 Server-Side Request Forgery (SSRF) in brainstormforce Starter Templates – AI-Powered Templates for Elementor & Gutenberg
Description
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Starter Templates – AI-Powered Templates for Elementor & Gutenberg WordPress plugin contains an SSRF vulnerability (CWE-918) in the ai_api_request() function. This flaw allows authenticated users with contributor-level privileges or higher to cause the server to make arbitrary HTTP requests to internal or external systems. The vulnerability affects all versions up to 4.1.6. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the low complexity and required privileges but limited impact on confidentiality and no impact on availability. No patch or official fix has been documented in the provided data.
Potential Impact
An authenticated attacker with contributor-level access can exploit this SSRF vulnerability to make arbitrary HTTP requests from the server hosting the WordPress plugin. This may enable the attacker to access or modify information on internal services that are otherwise inaccessible externally. The vulnerability does not directly impact confidentiality but can lead to information modification. There is no indication of impact on availability or known exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the ai_api_request() function. Avoid exposing internal services that could be targeted via SSRF. Follow vendor updates closely for any released patches or official mitigations.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-02-13T14:49:54.659Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6d31b7ef31ef0b56ed24
Added to database: 2/25/2026, 9:44:17 PM
Last enriched: 4/9/2026, 7:03:10 AM
Last updated: 4/12/2026, 2:44:10 AM
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.