WordPress Droit Elementor Addons Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2024-22136

8.8HIGH

Key Information:

Vendor
WordPress
Status
Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder
Vendor
CVE Published:
31 January 2024

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in DroitThemes Droit Elementor Addons, specifically impacting the Widgets, Blocks, and Templates Library intended for the Elementor Builder. This vulnerability can potentially allow unauthorized actions to be performed on behalf of authenticated users without their consent, leading to significant security risks. The affected versions include all releases prior to 3.1.5, highlighting an urgent need for users to update to the latest version to mitigate possible exploits.

Affected Version(s)

Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder <= 3.1.5

References

https://patchstack.com/database/vulnerability/droit-eleme...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elliot (Patchstack Alliance)
.