CVE-2026-17565 is a server-side request forgery (SSRF) vulnerability in the Animation Addons for Elementor WordPress plugin prior to version 2.7.2. The plugin fails to validate user-supplied input before using it to construct the host for server-side HTTP requests. This allows unauthenticated attackers to coerce the server into making arbitrary HTTP requests to internal or external systems and retrieve the responses, potentially exposing sensitive internal resources.

An unauthenticated attacker can exploit this vulnerability to make the vulnerable WordPress site perform HTTP requests on their behalf to internal network hosts or other unintended destinations. This can lead to information disclosure of internal services and data accessible to the server. The CVSS score of 7.2 indicates a high severity with low attack complexity and no required privileges or user interaction.

A fixed version 2.7.2 of the Animation Addons for Elementor plugin addresses this vulnerability by properly validating user input before using it in server-side requests. Users should upgrade to version 2.7.2 or later to remediate this issue. No other mitigation is indicated or required if the plugin is updated.