The Animation Addons for Elementor WordPress plugin versions prior to 2.7.2 contain a CWE-918 SSRF vulnerability. The plugin fails to validate user-supplied input before using it to build the host component of a server-side HTTP request. This allows unauthenticated attackers to coerce the server into making arbitrary HTTP requests to internal or external systems and potentially retrieve sensitive information from those responses.

An attacker can exploit this vulnerability to make the server perform unauthorized HTTP requests to internal network resources or other hosts accessible from the server. This can lead to information disclosure of internal services or data accessible via these requests. No evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.7.2, upgrading to version 2.7.2 or later is likely recommended once confirmed. Until then, restrict access to the plugin or disable it if possible to prevent exploitation.