Elementor Animation Addon SSRF Allows Internal Host Requests

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-17565 is a Server-Side Request Forgery (SSRF) vulnerability in the Animation Addons for Elementor WordPress plugin that allows unauthenticated attackers to manipulate HTTP requests made by the server itself. The flaw stems from insufficient validation of user-supplied input used to construct the host parameter in server-side HTTP requests, enabling attackers to redirect traffic toward internal networks, private IP addresses, or restricted services. This affects any WordPress site running the vulnerable plugin version before 2.7.2, putting both the site infrastructure and backend systems at risk. SSRF vulnerabilities are particularly dangerous because they bypass traditional network perimeter controls—the server becomes an unwitting proxy for attacking internal resources that would otherwise be inaccessible from the internet.

Casky's 331 mapped skills detect the attack patterns associated with this vulnerability through analysis of MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Claude's extended reasoning capabilities identify telltale indicators: anomalous HTTP requests originating from the WordPress application targeting unusual internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), metadata services (169.254.169.254), or localhost interfaces. Practitioners reviewing Casky findings would observe patterns of repeated requests to internal hosts with varying payloads, absence of legitimate user-agent strings matching expected client browsers, and response times inconsistent with normal plugin behavior. The platform's skill set flags CWE-918 violations where user input directly influences URL construction without proper sanitization, helping security teams distinguish this SSRF pattern from legitimate application traffic before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-17565.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-17565

Casky has 331 skills that investigate the attack patterns behind CVE-2026-17565. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn