CVE-2024-0513 Overview
CVE-2024-0513 is a Cross-Site Request Forgery (CSRF) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress. The flaw affects all versions up to and including 1.3.87. The issue stems from missing or incorrect nonce validation on the remove_from_wishlist function. Unauthenticated attackers can remove items from user wishlists by tricking a site administrator into clicking a crafted link or visiting a malicious page. The vulnerability is tracked as CWE-352: Cross-Site Request Forgery.
Critical Impact
Attackers can manipulate wishlist state on behalf of authenticated users through forged requests, requiring only that a targeted user visit a malicious page.
Affected Products
- Royal Elementor Addons and Templates plugin for WordPress
- All versions up to and including 1.3.87
- Fixed in version 1.3.88
Discovery Timeline
- 2024-02-29 - CVE-2024-0513 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0513
Vulnerability Analysis
The Royal Elementor Addons and Templates plugin exposes a remove_from_wishlist handler intended to let authenticated users manage saved items. In vulnerable releases, this handler does not validate a WordPress nonce, or validates it incorrectly. As a result, the endpoint cannot distinguish between a legitimate request originating from the plugin's own interface and a forged request triggered by an external site.
An attacker can host a page that issues a request to the target WordPress site. When an authenticated administrator or user visits that page, the browser automatically attaches session cookies. The plugin processes the request as if the user initiated it and removes the specified wishlist item.
The impact is limited to integrity of wishlist data. Confidentiality and availability are not directly affected, and no code execution is possible through this flaw.
Root Cause
The root cause is missing anti-CSRF protection on a state-changing endpoint. WordPress provides wp_verify_nonce() and check_ajax_referer() for exactly this purpose. The remove_from_wishlist function omits or misuses these checks, so any request bearing valid session credentials is accepted regardless of origin.
Attack Vector
Exploitation requires user interaction. An attacker crafts an HTML page containing a form, image tag, or JavaScript fetch call that targets the vulnerable endpoint on the victim WordPress site. The attacker then delivers the link through phishing, forum posts, or a compromised third-party site. When a logged-in user loads the malicious page, their browser sends the forged request with valid authentication cookies, and the plugin removes the targeted wishlist entry.
The attack does not require credentials, does not require prior access to the WordPress site, and works across origins because the server never verifies request provenance. For technical patch details, see the WordPress Plugin Changeset and the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-0513
Indicators of Compromise
- Requests to the plugin's wishlist AJAX action (remove_from_wishlist) with a Referer header pointing to an external or unexpected domain.
- Absence of a valid _wpnonce or nonce parameter on wishlist removal requests in web server logs.
- Unexpected wishlist state changes reported by authenticated users on the WordPress site.
Detection Strategies
- Review web server access logs for POST or GET requests to the plugin's wishlist endpoint that originate from off-site referers.
- Enable WordPress debug logging or a security plugin to flag AJAX actions missing nonce parameters.
- Correlate wishlist modification events with authenticated user session activity to identify anomalies.
Monitoring Recommendations
- Deploy a Web Application Firewall (WAF) rule that inspects requests to admin-ajax.php for the remove_from_wishlist action and blocks those without a valid nonce.
- Monitor plugin version inventory across managed WordPress sites and alert when instances remain at 1.3.87 or earlier.
- Track outbound clicks and phishing indicators that could deliver CSRF payloads to authenticated administrators.
How to Mitigate CVE-2024-0513
Immediate Actions Required
- Update the Royal Elementor Addons and Templates plugin to version 1.3.88 or later on all WordPress installations.
- Audit administrator and editor accounts, and enforce that privileged users do not browse untrusted sites while authenticated.
- Deploy a WAF ruleset that blocks requests to the vulnerable endpoint lacking a valid WordPress nonce.
Patch Information
The vendor addressed the issue in Royal Elementor Addons and Templates version 1.3.88. The fix adds proper nonce validation to the remove_from_wishlist handler. Review the code change in the WordPress Plugin Changeset.
Workarounds
- If patching is temporarily not possible, disable the Royal Elementor Addons wishlist feature until the plugin is updated.
- Restrict administrator sessions using SameSite cookie policies and short session lifetimes to reduce CSRF exposure.
- Require administrators to use a dedicated browser or profile for WordPress management to isolate authenticated sessions from general browsing.
# Update the plugin via WP-CLI
wp plugin update royal-elementor-addons --version=1.3.88
wp plugin list --name=royal-elementor-addons --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
