What is the CVSS score of CVE-2025-31413?

CVE-2025-31413 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-31413?

Within 24 hours: Inventory all WordPress instances using bdthemes Element Pack Elementor Addons and disable the plugin if not critical to operations. Within 7 days: Implement WAF rules to detect and block CSRF attacks targeting the plugin, review user activity logs for suspicious administrative actions, and establish communication with bdthemes for patch availability. Within 30 days: Apply the vendor patch immediately upon release, conduct security awareness training on CSRF risks, and consider alternative plugins with better security track records.

CVE-2025-31413

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-01-22 audit@patchstack.com

CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 4.3 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:15 nvd

HIGH 8.8

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Cross Site Request Forgery.This issue affects Element Pack Elementor Addons: from n/a through <= 8.3.13.

AnalysisAI

bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite is affected by cross-site request forgery (csrf) (CVSS 8.8).

Technical ContextAI

This vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affects bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite. Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Cross Site Request Forgery.This issue affects Element Pack Elementor Addons: from n/a through <= 8.3.13.