CVE-2024-4404

The ElementsKit PRO plugin for WordPress before version 3.6.3 contains a server-side request forgery vulnerability in the 'render_raw' function that allows authenticated users with contributor access or higher to send web requests to any location on behalf of the server. An attacker exploiting this flaw could interact with internal services to read or alter sensitive information accessible from the compromised web application.

Based on public CVE data (MITRE/NVD).