What’s Vulnerable › Vulnerabilities

CVE-2024-4404: ElementsKit PRO <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-14 · updated 2026-06-17
• Weakness: CWE-918

Description

The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'render_raw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected products

• wpmet ElementsKit Pro: before 3.6.3 — fixed in 3.6.3

How to fix

Upgrade to a fixed version: wpmet ElementsKit Pro 3.6.3. Check the vendor advisory for mitigations.

References

• https://wpmet.com/plugin/elementskit/roadmaps/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6417269d-3d49-4f33-b92a-5aacb052bab0?source=cve
• https://wpmet.com/plugin/elementskit/roadmaps/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6417269d-3d49-4f33-b92a-5aacb052bab0?source=cve

Get alerted when CVE-2024-4404 or the next vulnerability affects your stack