Description

Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-20T13:17:27.250Z",
  "pubdate": "2026-08-20T13:17:27.250Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the HashThemes Easy Elementor Addons plugin. This security flaw enables malicious threat actors to trick authenticated users into executing unintended actions on the affected WordPress site without their consent.\nThe vulnerability impacts Easy Elementor Addons from version n/a through 2.3.7. The primary risk implication centers on unauthorized state-changing operations being performed on behalf of high-privileged users, potentially leading to unauthorized configurations, privilege escalation vectors, or further system compromise depending on the targeted administrative functionalities.\nExploitation of this vulnerability typically requires an attacker to interact with a victim—such as crafting a malicious external website or phishing link containing forged HTTP requests—and enticing an authenticated administrator or user with adequate privileges to load the content while maintaining an active session on the vulnerable target application.\nGiven the nature of CSRF vectors, the attack relies entirely on the browser automatically including session cookies or authentication tokens in cross-origin requests, thereby bypassing standard perimeter defenses if proper anti-CSRF nonce validation or SameSite cookie policies are absent within the vulnerable component.",
  "technicalDetails": "The root cause of this vulnerability stems from the absence or improper implementation of cryptographic nonces or anti-CSRF token verification mechanisms within the request-handling routines of the Easy Elementor Addons plugin.\nBecause state-changing HTTP requests lack validation mechanisms to confirm whether the request originated from the legitimate user interface, an external malicious domain can successfully forge requests targeting administrative endpoints exposed by the plugin.\nThe affected product is Easy Elementor Addons across versions from n/a through 2.3.7. The vulnerable component resides within the plugin's backend request handlers that process administrative configurations or operational parameters.\nThe attack flow proceeds as follows: First, the attacker identifies a specific state-changing action endpoint within the plugin that lacks anti-CSRF protection. Second, the attacker constructs a malicious payload, typically embedded within an external HTML document via an auto-submitting form, an image tag, or asynchronous JavaScript (XMLHttpRequest or Fetch API) configured to trigger a cross-origin request to the vulnerable WordPress instance.\nThird, the attacker social-engineers an authenticated administrator of the target WordPress site into visiting the malicious URL or viewing the crafted web page while holding a valid session.\nFourth, the victim's browser automatically appends session cookies and authentication credentials to the cross-origin request directed at the vulnerable site.\nFifth, the server processes the incoming HTTP request, failing to verify the provenance of the action due to the missing nonce validation, and subsequently executes the requested administrative modification.\nAuthentication and privilege requirements for the ultimate success of the attack dictate that the victim must possess authenticated administrative or high-level user privileges within the WordPress environment, as the forged actions rely on the victim's permission level to execute restricted operations.\nThe network exposure is web-based, requiring network accessibility to the targeted WordPress installation. Post-exploitation impact may include unauthorized plugin setting modifications, unauthorized data insertion, or the potential establishment of secondary persistence vectors within the content management system."
}