The ShopEngine Elementor WooCommerce Builder Addon plugin is vulnerable to a CSRF flaw caused by missing nonce validation on the "post_add_to_list" endpoint and an incorrect permissions callback in its API initialization. An attacker who can convince a site user to visit a crafted link can add or remove items from that user's wishlist without authentication. The impact is a moderate integrity violation and potential commercial impact for e‑commerce sites that rely on wishlist integrity, but it does not expose sensitive data or allow code execution.

All users of the roxnor ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with version 4.8.5 or earlier are affected. Versions higher than 4.8.5 include the fix and are not vulnerable.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% implies a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is web‑based: a malicious link or HTML payload that triggers a forged POST request to the vulnerable endpoint, requiring the victim to click the link or visit an embedded resource. Successful exploitation would allow an attacker to manipulate a user’s wishlist but does not enable broader attacks such as data exfiltration or remote code execution.