CVE-2025-11536

The Element Pack Addons for Elementor plugin in WordPress contains a flaw that allows malicious users with at least subscriber privileges to craft server-side requests that bypass security checks, enabling them to access and manipulate data on external systems by leveraging the wp_ajax_import_elementor_template action. This vulnerability affects all versions of the plugin up to 8.2.5. As a result, attackers can exploit this weakness to extract or alter sensitive information from internal services.

Based on public CVE data (MITRE/NVD).