CVE-2025-31413: CSRF in Element Pack Elementor Addons

A successful CSRF attack can have significant consequences for websites using Element Pack Elementor Addons. An attacker could leverage this vulnerability to modify website content, change user roles, delete critical data, or even gain administrative access. The impact is amplified if the website handles sensitive user data or performs critical business functions. The attacker needs to craft a malicious request and trick the user into clicking a link or visiting a compromised page. This vulnerability is similar in nature to other CSRF vulnerabilities, but the specific impact depends on the permissions and functionalities exposed by Element Pack.

1. Reserved2025-03-28
2. Published2026-01-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-31413 is to immediately upgrade Element Pack Elementor Addons to version 8.3.14 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These might include adding CSRF tokens to all sensitive forms and actions within Element Pack, or using a Web Application Firewall (WAF) to filter out malicious requests. Review and restrict user permissions to minimize the potential damage from a successful attack. After upgrade, confirm the fix by attempting a CSRF attack on a test environment and verifying that the request is blocked or fails.

Active installs

100KKnown

Plugin rating