CVE-2026-28164 in Easy Elementor Addons Plugin
Summary
by MITRE • 08/20/2026
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery.
This issue affects Easy Elementor Addons: from n/a through 2.3.7.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The identified security flaw represents a classic Cross-Site Request Forgery (CSRF) vulnerability within the HashThemes Easy Elementor Addons plugin for WordPress, specifically impacting versions ranging from initial releases up to version 2.3.7. This type of attack exploits the trust that a web application has in the user's browser by tricking the victim into performing unintended actions on behalf of an authenticated attacker. In this context, the vulnerability arises because the affected plugin endpoints fail to implement adequate anti-CSRF mechanisms, such as unique per-session tokens or strict validation of the Origin and Referer headers, which are standard defenses against unauthorized state-changing requests.
From a technical perspective, CSRF attacks leverage the fact that browsers automatically include credentials like session cookies with every request made to a domain where the user is currently logged in. An attacker can craft a malicious webpage containing hidden forms or JavaScript commands that trigger HTTP POST or GET requests to specific endpoints within the Easy Elementor Addons plugin. Because these requests are initiated by the victim's browser while they have an active, authenticated session with the WordPress site, the server processes them as legitimate actions authorized by the user. This allows the attacker to manipulate state without needing to know the user's password or bypass authentication checks directly.
The operational impact of this vulnerability is significant depending on the privileges held by the targeted user account and the specific functionality exposed through the vulnerable endpoints. If an administrator with high-level capabilities falls victim to such a request, it could lead to unauthorized modifications of website settings, installation of malicious plugins, creation of new administrative users, or deletion of content. For lower-privileged users, the impact might be limited but still disruptive, potentially involving unintended changes to page layouts created via Elementor or other addon features. The lack of proper validation means that any action requiring authentication can be forced upon a user simply by them visiting a malicious site while logged into their WordPress dashboard elsewhere in another tab.
This vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as the ability to send unauthorized commands from an authenticated user. Furthermore, within the MITRE ATT&CK framework for enterprise security, this behavior maps to T1076, known as Remote File Inclusion or more broadly under techniques involving browser-based attacks where social engineering is used to induce a victim into performing actions that compromise system integrity. The absence of CSRF tokens in form submissions and AJAX calls constitutes a fundamental deviation from secure coding practices recommended by OWASP for preventing such forgery attempts.
To mitigate this risk, immediate action should be taken by updating the Easy Elementor Addons plugin to version 2.3.8 or later, where these security flaws have been addressed by developers through the implementation of proper nonce verification and state validation mechanisms. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include restricting access to WordPress admin areas via IP whitelisting if feasible, ensuring that all administrative accounts use strong, unique passwords combined with multi-factor authentication where supported, and monitoring server logs for unusual patterns of POST requests originating from unexpected referrers or user agents. Additionally, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by filtering out malicious traffic based on behavioral analysis before it reaches the application logic.