CVE-2025-46257

WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Published Jun 5, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.

Analysis

Technical impact

The vulnerability is a CSRF flaw that allows an attacker to trigger authenticated requests in a WordPress site using the Element Pack Pro plugin. It is classified as CWE‑352 and has a CVSS score of 4.3, indicating moderate severity.

Affected Systems

BdThemes Element Pack Pro plugin versions prior to 8.0.0 on WordPress sites are affected. Sites running any earlier or unspecified version are vulnerable until the upgrade to 8.0.0 or later.

Risk and Exploitability

The EPSS score of < 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, so there are no known large‑scale exploits. An attacker would need to trick a logged‑in user into visiting a crafted URL or form to trigger an authorized action, implying that the attack surface is limited to users who have access to the plugin’s authenticated endpoints.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

BdThemes

Element Pack Pro

unaffected

Version	Status	Constraints
`n/a`	affected	< 8.0.0

No data.

No data available yet.

Remediation

Vendor Solution

Update the WordPress Element Pack Pro wordpress plugin to the latest available version (at least 8.0.0).

OpenCVE Recommended Actions

Update the BdThemes Element Pack Pro plugin to version 8.0.0 or later
Review WordPress plugin update settings to automate future patching
If upgrade is not immediately possible, restrict access to the plugin’s administrative pages or disable the plugin until a patch is available

Generated by OpenCVE AI on May 1, 2026 at 08:00 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-17011	Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.149% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

History

Apr 28, 2026 7:45 PM References updated View changes

Type	Values Removed	Values Added
References	https://patchstack.com/database/Wordpress/Plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Apr 28, 2026 6:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro bdthemes-element-pack allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a through < 8.0.0.	Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.
References		https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Apr 23, 2026 3:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Apr 23, 2026 3:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.	Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro bdthemes-element-pack allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a through < 8.0.0.
References		https://patchstack.com/database/Wordpress/Plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Jun 5, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 5, 2025 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Cross-Site Request Forgery (CSRF) vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0.
Title		WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Weaknesses		CWE-352
References		https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack/vulnerability/wordpress-element-pack-pro-plugin-7-18-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}`