The Element Pack – Widgets, Templates & Addons for Elementor plugin for WordPress contains a Blind SSRF vulnerability (CWE-918) identified as CVE-2025-11536. This vulnerability exists in all versions up to 8.2.5 and is exploitable via the wp_ajax_import_elementor_template action. An attacker with at least Subscriber-level privileges can cause the server to make HTTP requests to arbitrary locations, potentially accessing or modifying internal service data. The CVSS 3.1 base score is 5.0, indicating medium severity. There is no information about an available patch or official vendor remediation at this time.

An authenticated attacker with Subscriber-level access or higher can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests. This may allow the attacker to interact with internal services that are not otherwise accessible externally, potentially leading to information disclosure or unauthorized data modification within internal networks. The vulnerability does not directly impact confidentiality or availability but can lead to limited confidentiality impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the wp_ajax_import_elementor_template action. Consider disabling or restricting the vulnerable plugin if possible.