Easy Elementor Addons EUVD-2026-63327

Exploitation requires an authenticated user - realistically an administrator or privileged operator - to have an active WordPress session and to be tricked into interacting with attacker-controlled content (CVSS UI:R), for example visiting a malicious page or clicking a crafted link. There is no evidence of an authentication requirement on the attacker side (PR:N), but the attack cannot succeed without a valid victim session and that victim's interaction; it also depends on the site running Easy Elementor Addons ≤2.3.7. The mandatory user interaction and dependency on a logged-in privileged victim are the principal factors limiting real-world exploitation, restricting it to social-engineering-driven, targeted attempts rather than unattended mass exploitation.

Signals are mixed. The Patchstack/NVD-style CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6 Critical) is aggressive for a CSRF: it assumes the forged action yields full confidentiality, integrity, and availability loss with a scope change, which would only hold if the vulnerable action enables site takeover (e.g., injecting content/settings that lead to code execution). In practice CSRF impact is bounded by the sensitivity of the single action reachable without a nonce, and no EPSS score, POC, or KEV entry is present to corroborate real-world exploitation - so this reads as a high-CVSS rating whose worst-case impact assumptions are not independently substantiated by the sparse description. The genuine limiting factor is UI:R: an authenticated administrator must be actively induced to visit or interact with attacker content while logged in, which narrows opportunistic mass exploitation. Defenders running the plugin should still patch promptly given the Critical rating and the low technical bar to craft a CSRF, but the absence of exploit evidence suggests prioritizing it as an important-but-not-emergency fix rather than treating it as confirmed active compromise.

An attacker crafts a malicious web page or email containing a hidden form or image that auto-submits a request to a vulnerable Easy Elementor Addons endpoint. When a logged-in WordPress administrator is lured into loading that content, their browser silently replays their authenticated session against the site, performing the attacker-chosen state change. No public exploit is identified at time of analysis, so a working PoC would need to be developed against the specific unprotected action.