Cross-Site Request Forgery in Blog Designer for Elementor Plugin by WordPress
CVE-2025-8481
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 September 2025
What is CVE-2025-8481?
The Blog Designer For Elementor - Post Slider, Post Carousel, Post Grid plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability in version 1.1.7. This flaw arises from inadequate nonce validation in the bdfe_install_activate_rswpbs_only function. As a result, unauthenticated attackers could exploit this weakness to install the 'rs-wp-books-showcase' plugin, given they can deceive a site administrator into executing a specific action, such as clicking a malicious link.
Affected Version(s)
Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid * <= 1.1.7