CVE-2025-11536

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11536", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-08T22:16:18.680Z", "datePublished": "2025-10-20T21:23:48.282Z", "dateUpdated": "2026-04-08T17:10:32.363Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:32.363Z"}, "affected": [{"vendor": "bdthemes", "product": "Element Pack \u2013 Widgets, Templates & Addons for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_elementor_template action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97c100c3-8a96-4198-b38a-206268ff20ec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.2.4/includes/setup-wizard/init.php#L420"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "LionTree"}], "timeline": [{"time": "2025-09-29T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-09T11:42:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-20T08:59:46.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-21T13:43:07.099730Z", "id": "CVE-2025-11536", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T14:09:22.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "LionTree"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "bdthemes", "product": "Element Pack Addons for Elementor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "8.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-29T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-10-09T11:42:00.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-20T08:59:46.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97c100c3-8a96-4198-b38a-206268ff20ec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.2.4/includes/setup-wizard/init.php#L420"}], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_elementor_template action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-20T21:23:48.282Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11536", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-21T13:43:07.099730Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-10-21T13:43:09.434Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-11536", "state": "PUBLISHED", "dateUpdated": "2025-10-20T21:23:48.282Z", "dateReserved": "2025-10-08T22:16:18.680Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-20T21:23:48.282Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Element Pack \u2013 Widgets, Templates & Addons for Elementor", "vendor": "bdthemes", "versions": [{"lessThanOrEqual": "8.2.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_elementor_template action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Element Pack Addons para Elementor para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor ciega en todas las versiones hasta la, e incluyendo, 8.2.5 a trav\u00e9s de la acci\u00f3n wp_ajax_import_elementor_template. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede ser utilizado para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-11536", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11536", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-21T13:43:07.099730Z", "version": "2.0.3"}}]}, "published": "2025-10-20T22:15:36.727", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.2.4/includes/setup-wizard/init.php#L420"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97c100c3-8a96-4198-b38a-206268ff20ec?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:42:21.133144+00:00", "value": {"mitigation_remediation": ["Upgrade Element Pack \u2013 Widgets, Templates & Addons for Elementor to version 8.2.6 or later to eliminate the SSRF flaw.", "Disable or restrict access to the wp_ajax_import_elementor_template action for users with only Subscriber-level permissions.", "Introduce network segmentation or firewall rules to block outgoing requests from the web server to internal services that should remain inaccessible."], "summary": {"action": "Patch Immediately", "impact": "Blind Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "bdthemes Element Pack \u2013 Widgets, Templates & Addons for Elementor, versions up to 8.2.5", "description_and_impact": "The Element Pack Addons for Elementor plugin contains a blind server\u2011side request forgery flaw that allows authenticated users with Subscriber level or higher to direct the application to make HTTP requests to arbitrary hosts. Because the requests are made from the web server\u2019s environment, the attacker can interact with internal networks that are otherwise inaccessible from the outside. The flaw can lead to data leaks, unauthorized changes to internal services, or further exploitation such as privilege escalation. The weakness is classified as CWE\u2011918.", "risk_and_exploitability": "The CVSS score of 5 indicates moderate potential for impact, while an EPSS score under 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must already be authenticated as a Subscriber or higher in the WordPress site and then invoke the import template action to send forged requests from the host."}}}}, "created": "2025-10-21T09:39:40.341970+00:00", "updated": "2026-04-22T12:45:17.030039+00:00", "vendors": ["bdthemes", "bdthemes$PRODUCT$element_pack", "bdthemes$PRODUCT$element_pack_elementor_addons", "element_pack_elementor_addons_wordpress", "element_pack_elementor_addons_wordpress$PRODUCT$element_pack_elementor_addons_wordpress", "wordpress", "wordpress$PRODUCT$wordpress"]}