CVE-2025-14163
CSRF in Premium Addons for Elementor Enables Template Injection
Publication date: 2025-12-23
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| premium_addons | premium_addons_for_elementor | 4.11.53 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Premium Addons for Elementor WordPress plugin (up to version 4.11.53). It occurs because the 'insert_inner_template' function lacks nonce validation, allowing unauthenticated attackers to trick users with the 'edit_posts' capability (like site administrators) into performing actions such as creating arbitrary Elementor templates via forged requests. [1]
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to create arbitrary Elementor templates on a vulnerable WordPress site by tricking an authorized user into executing a forged request. This can lead to unauthorized content insertion or manipulation within the site, potentially affecting site integrity and user trust. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the Premium Addons for Elementor plugin version is 4.11.53 or earlier and by monitoring for unauthorized AJAX requests to the 'insert_inner_template' action without proper nonce validation. You can look for suspicious POST requests to admin-ajax.php with the action 'premium_inner_template' that do not include valid nonce tokens. A sample command to detect such requests in web server logs could be: `grep 'action=premium_inner_template' /var/log/apache2/access.log` or using a network monitoring tool to filter HTTP POST requests to admin-ajax.php containing 'premium_inner_template'. Additionally, inspecting WordPress user activity logs for unexpected template insertions by users with 'edit_posts' capability may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Premium Addons for Elementor plugin to a version later than 4.11.53 where the nonce validation issue is fixed. If an update is not immediately available, restrict access to users with 'edit_posts' capability and monitor or block suspicious AJAX requests to 'premium_inner_template'. Implementing Web Application Firewall (WAF) rules to block forged requests targeting this AJAX action can also help. Additionally, educating site administrators to avoid clicking on suspicious links that could trigger CSRF attacks is recommended. [1]