CVE-2026-39719: CWE-918 Server-Side Request Forgery (SSRF) in DeKnows PDF Smart Viewer for Elementor

This vulnerability (CVE-2026-39719) is an unauthenticated SSRF issue in DeKnows PDF Smart Viewer for Elementor versions up to 1.0.4. SSRF vulnerabilities enable attackers to make the vulnerable server perform HTTP requests to arbitrary domains, potentially leading to information disclosure or other impacts depending on the server environment. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and a scope change with low confidentiality and integrity impacts but no availability impact.

An attacker can exploit this SSRF vulnerability without authentication to cause the server hosting PDF Smart Viewer for Elementor to send crafted HTTP requests. This can lead to limited confidentiality and integrity impacts, such as accessing internal resources or manipulating server-side interactions. There is no indication of availability impact or known active exploitation in the wild.

No patch or remediation information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting outbound HTTP requests from the server or applying network-level controls to limit SSRF exploitation.