The vulnerability is a Cross‑Site Request Forgery flaw in the quomodosoft ElementsReady Addons for Elementor plugin (element‑ready-lite), identified as CWE‑352. An attacker who can trick an authenticated administrator or user into visiting a crafted URL can cause the browser to send privileged requests to the plugin’s endpoints, enabling unauthorized actions such as changing settings or triggering operations without the user’s consent.

WordPress sites running the ElementsReady Addons for Elementor plugin from any version through 6.6.2 are affected. The issue was identified in all releases up to and including 6.6.2. No more recent versions were noted to contain the flaw.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require a user to be logged in to the site and visit a maliciously crafted link; the plugin’s lack of CSRF protection allows the attacker’s request to be performed with the victim’s credentials.