CVE-2024-0512 Overview
CVE-2024-0512 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Royal Elementor Addons and Templates plugin for WordPress. The flaw exists in all versions up to and including 1.3.87. It stems from missing or incorrect nonce validation on the add_to_wishlist function. Unauthenticated attackers can add items to user wishlists by tricking an authenticated administrator into clicking a crafted link. The issue is tracked under CWE-352 and was patched in version 1.3.88.
Critical Impact
Unauthenticated attackers can force site administrators to add arbitrary items to user wishlists through forged requests, requiring only that the administrator interact with attacker-controlled content.
Affected Products
- Royal Elementor Addons and Templates plugin for WordPress
- All versions up to and including 1.3.87
- Fixed in version 1.3.88
Discovery Timeline
- 2024-02-29 - CVE-2024-0512 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0512
Vulnerability Analysis
The vulnerability resides in the add_to_wishlist function of the Royal Elementor Addons and Templates plugin. WordPress relies on nonces, cryptographic tokens tied to a user session, to validate that state-changing requests originate from a legitimate source. The affected function either omits nonce checks entirely or implements them incorrectly. Any request reaching the endpoint is processed without verifying user intent.
An attacker can craft a malicious HTML page or link that submits a request to the vulnerable endpoint on the target WordPress site. When an authenticated administrator loads the attacker-controlled content, the browser sends the forged request using the administrator's active session cookies. The wishlist modification then executes with the administrator's privileges.
The impact scope is limited to integrity of wishlist data. There is no confidentiality or availability impact, and the affected function does not expose broader administrative operations.
Root Cause
The root cause is missing or improperly implemented nonce validation in the add_to_wishlist handler. WordPress plugins are expected to call wp_verify_nonce() or check_admin_referer() on any endpoint that changes server-side state. The plugin failed to enforce this control on the wishlist endpoint.
Attack Vector
Exploitation requires social engineering. The attacker hosts a webpage containing a hidden form or image tag that references the vulnerable endpoint on the target WordPress site. The attacker then sends the page URL to a site administrator through phishing, forum posts, or comments. When the administrator visits the page while authenticated to the target site, the browser automatically submits the forged request.
No authentication is required from the attacker. The victim must have an active session with the vulnerable WordPress site at the time of interaction.
No verified public proof-of-concept code is available. For technical specifics, see the Wordfence Vulnerability Report and the WordPress Plugin Change Log.
Detection Methods for CVE-2024-0512
Indicators of Compromise
- Unexpected entries in user wishlist tables originating from administrator accounts or unusual IP addresses
- HTTP POST or GET requests to the add_to_wishlist endpoint that lack a valid Referer header pointing to the site
- Requests to the wishlist endpoint containing no nonce parameter or an invalid nonce value
- Spikes in wishlist activity correlated with administrator sessions accessing external links
Detection Strategies
- Review web server access logs for requests to the vulnerable add_to_wishlist action with off-site or missing Referer headers
- Correlate WordPress user session activity with wishlist modification events to identify forged submissions
- Deploy web application firewall rules that require nonce parameters on state-changing plugin endpoints
- Audit installed plugin versions across WordPress deployments to identify hosts running Royal Elementor Addons 1.3.87 or earlier
Monitoring Recommendations
- Enable WordPress audit logging plugins to record wishlist and user-account changes with source IP and referrer data
- Alert on cross-origin POST requests to /wp-admin/admin-ajax.php targeting Royal Elementor actions
- Monitor plugin update status to confirm all instances are patched to version 1.3.88 or later
How to Mitigate CVE-2024-0512
Immediate Actions Required
- Update the Royal Elementor Addons and Templates plugin to version 1.3.88 or later on all WordPress installations
- Verify plugin version through the WordPress admin dashboard under Plugins after applying the update
- Review recent wishlist activity for anomalous entries created during the vulnerable window
- Instruct administrators to log out of WordPress sessions before visiting untrusted links
Patch Information
The vendor released version 1.3.88 to address CVE-2024-0512 by adding proper nonce validation to the add_to_wishlist function. The code change is documented in the WordPress Plugin Change Log. Administrators should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Deactivate the Royal Elementor Addons and Templates plugin until the update to 1.3.88 can be applied
- Restrict administrator access to the WordPress site from dedicated browsers or sessions not used for general web browsing
- Deploy a web application firewall rule that blocks requests to the add_to_wishlist action lacking a same-origin Referer header
# Update the plugin using WP-CLI
wp plugin update royal-elementor-addons --version=1.3.88
# Verify the installed version
wp plugin get royal-elementor-addons --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
