CVE-2024-4404 is a High (CVSS 8.5) server side request forgery in the ElementsKit PRO plugin for WordPress, in versions up to and including 3.6.2, through the render_raw function. Authenticated users at contributor level or higher can make the server send requests. Update the plugin.
What's affected
- Product: ElementsKit PRO, the paid add on from wpmet, for WordPress and Elementor.
- Affected versions: up to and including 3.6.2.
- Fixed version: not named in the record. Its reference is the vendor roadmap page, which I did not fetch. Use the newest release from your license account.
- Severity: High, CVSS 8.5, with a changed scope and a low privilege requirement.
- Who can use it: authenticated users with contributor permissions or above.
- Exploitation: KEV is false.
How to check if you're exposed
ElementsKit PRO is a premium plugin, so it may not show update notices in the same way as plugins from the WordPress directory. Check the version in the dashboard under Plugins, or run:
wp plugin list --fields=name,version,update
Then list the users with contributor role or higher. Sites with open registration or guest authors have more users in scope. Review those accounts for any you cannot explain.
What to do now
- Check the ElementsKit PRO version and update it past 3.6.2 using your license download.
- Review user accounts with contributor, author, editor or administrator roles.
- Turn off open registration if you do not need it.
- Restrict outbound requests from the web server to the destinations it needs, and block cloud metadata addresses.
- Check that automatic updates for premium plugins are working.
Why it matters
The record maps this to CWE-918, server side request forgery. The render_raw function fetches a location on behalf of the user. Because the request comes from the web server, it can reach internal services that outsiders cannot.
The record notes that it can query and modify information from internal services. Contributor level is a low bar on many sites, so treat any account of that type as a possible starting point.
Quick check
Do I need to be an administrator to use it?
No. The record says contributor level and above, which is a low privilege.
Why mention internal services?
Server side requests can reach addresses only the server can access, such as admin panels and cloud metadata services.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4404 (published 2024-06-14) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
