The Avada theme for WordPress and WooCommerce contains an SSRF vulnerability (CWE-918) in the form_to_url_action function. This flaw allows authenticated users with contributor-level privileges or above to cause the server to send HTTP requests to arbitrary URLs. Such requests originate from the vulnerable web application, potentially enabling attackers to interact with internal network services or other unintended targets. The vulnerability affects all versions up to 7.11.6. No official patch or vendor advisory has been provided yet, and no known exploits are reported in the wild.

An attacker with contributor-level access or higher can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may lead to unauthorized querying or modification of internal services accessible from the server, potentially exposing sensitive information or enabling further attacks within the internal network. The impact is limited by the requirement for authenticated access with contributor privileges, reducing the risk from unauthenticated attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the form_to_url_action function. Avoid exposing sensitive internal services to the vulnerable server environment.