The vulnerability is a CSRF flaw that allows an attacker to trigger authenticated requests in a WordPress site using the Element Pack Pro plugin. It is classified as CWE‑352 and has a CVSS score of 4.3, indicating moderate severity.

BdThemes Element Pack Pro plugin versions prior to 8.0.0 on WordPress sites are affected. Sites running any earlier or unspecified version are vulnerable until the upgrade to 8.0.0 or later.

The EPSS score of < 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, so there are no known large‑scale exploits. An attacker would need to trick a logged‑in user into visiting a crafted URL or form to trigger an authorized action, implying that the attack surface is limited to users who have access to the plugin’s authenticated endpoints.