CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the import_templates() function. This makes it possible for unauthenticated attackers to trigger an import via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
The Digital Marketing and Agency Templates Addons for Elementor plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators without their knowledge. An attacker can craft a malicious link or page that, when visited by an admin, triggers unwanted changes to the site. No special privileges or user interaction beyond visiting a page is required from the attacker's perspective.
What an attacker can do
Perform unauthorized actions on the site by tricking an admin into visiting a malicious page.
Potential impact on your site
Attackers can modify site settings, content, or configuration without your permission if you visit a malicious link.
Conditions required to exploit
Site admin must visit a page controlled by the attacker while logged into WordPress.
Key dates
External resources
Related vulnerabilities
