CVE-2024-0516 MEDIUM

CVE-2024-0516: Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta

Vendor Wproyal
Product Royal Addons for Elementor – Addons and Templates Kit for Elementor
Weakness CWE-352 · CSRF
Published February 20, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.

Key dates

02Disclosure timeline

February 20, 2024 CVE published
April 8, 2026 Record updated