The vulnerability is a Cross‑Site Request Forgery flaw found in the bdthemes Element Pack Elementor Addons plugin for WordPress. The flaw allows an attacker to force a logged‑in user to perform actions that the user did not intend, by crafting a request that the plugin will accept as legitimate. The vulnerability does not specify that it enables arbitrary code execution or file uploads; it simply permits unauthorized actions that the authenticated user could perform.

The bdthemes Element Pack Elementor Addons plugin, including the element‑pack-lite variant, is vulnerable in all releases up to and including version 8.3.13 on WordPress sites.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% shows a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to get the victim to visit a specially crafted URL or otherwise submit a forged request while authenticated, implying that valid user interaction is necessary for the attack to succeed.