The Premium Addons for Elementor plugin for WordPress, up to version 4.11.53, suffers from a Cross‑Site Request Forgery (CWE‑352) due to missing nonce validation in the 'insert_inner_template' function. An unauthenticated attacker who can persuade an administrator or a user with edit_posts capability to follow a crafted link can have the site create arbitrary Elementor templates. These templates may embed malicious content or scripts, potentially leading to site defacement or a vector for further code execution when the templates are activated.

Affected product is the leap13 Premium Addons for Elementor plugin for WordPress. All releases through version 4.11.53 are vulnerable. The plugin is commonly used with Elementor on WordPress sites and is distributed via the WordPress plugin repository.

The CVSS score of 4.3 marks this vulnerability as moderate. An EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to supply a forged request to the plugin's insert_inner_template endpoint and compel a user with edit capability to click the link. Because nonce checks are omitted, the action is executed automatically, making the exploit simple once the social engineering precondition is satisfied.