The Prime Slider – Addons for Elementor plugin for WordPress contains an SSRF vulnerability (CWE-918) in versions up to and including 4.0.9. The issue arises through the import_elementor_template AJAX action, which allows authenticated attackers with subscriber-level privileges or higher to induce the server to make HTTP requests to arbitrary locations. This can be leveraged to interact with internal services that are otherwise inaccessible externally. The vulnerability is tracked as CVE-2025-14277 with a CVSS 3.1 base score of 4.3 (medium severity). No known exploits in the wild have been reported, and no patch or remediation details are provided at this time.

An attacker with at least subscriber-level access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may enable the attacker to access or modify data from internal services that are not directly reachable from outside the network. The impact is limited to information disclosure (confidentiality impact is low), with no direct integrity or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to the import_elementor_template AJAX action. Avoid granting unnecessary privileges to users and consider disabling or limiting the use of the vulnerable plugin if feasible.