Executive brief
Easy Elementor Addons is a WordPress plugin that extends the Elementor page builder with additional design components. A CSRF vulnerability in versions up to 2.3.7 allows attackers to trick logged-in site administrators into performing unintended actions, such as modifying site settings or creating content, by crafting malicious web pages that the admin unknowingly interacts with.
Technical details
This is a classic cross-site request forgery (CSRF) vulnerability affecting the Easy Elementor Addons WordPress plugin through version 2.3.7. The vulnerability occurs because the plugin fails to implement proper nonce verification (CSRF tokens) on state-changing operations, allowing unauthenticated attackers to craft malicious requests that execute with the privileges of a logged-in administrator. Exploitation requires user interaction—specifically a logged-in admin must click a malicious link or visit a crafted page—but no authentication is needed from the attacker. Successful exploitation can result in arbitrary actions being performed on behalf of the victim user, such as modifying plugin settings, creating posts, or altering site configuration. The fix is available in version 2.3.8 and later.
Affected products
- HashThemes Easy Elementor Addons through 2.3.7
Timeline
- 2026-07-19: disclosed: Reported to Patchstack
- 2026-08-20: advisory: Published by Patchstack
- 2026-08-20: patched: Fix available in version 2.3.8