CVE-2024-0513: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce val...

Summary

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_wishlist function. This makes it possible for unauthenticated attackers to r...

What to do

Update royal-elementor-addons royal_elementor_addons to version 1.3.88 or later.

Affected software

Vendor	Product	Affected versions
royal-elementor-addons	royal_elementor_addons	< 1.3.88 `cpe:2.3:a:royal-elementor-addons:royal_elementor_addons::::::wordpress::*`

Original advisory text

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce val...

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_wishlist function. This makes it possible for unauthenticated attackers to remove items from user wishlists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old... Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/3d3516e7-cce4-4def-be3... Third Party Advisory