CVE-2024-0514: Royal Elementor Addons CSRF Vulnerability

CVE-2024-0514 Overview

CVE-2024-0514 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Royal Elementor Addons and Templates plugin for WordPress. The flaw affects all plugin versions up to and including 1.3.87. The root cause is missing or incorrect nonce validation on the add_to_compare function. Unauthenticated attackers can forge requests that add items to user compare lists when a site administrator is tricked into clicking a malicious link. Exploitation depends on user interaction and does not permit code execution, but it undermines the integrity of user session data on affected sites.

Critical Impact
An unauthenticated attacker can manipulate compare list state on behalf of an authenticated user by convincing them to visit a crafted page.

Affected Products

Royal Elementor Addons and Templates plugin for WordPress
All versions up to and including 1.3.87
Fixed in version 1.3.88

Discovery Timeline

2024-02-29 - CVE-2024-0514 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0514

Vulnerability Analysis

The vulnerability resides in the add_to_compare function exposed by the Royal Elementor Addons and Templates plugin. The function processes requests without validating a WordPress nonce token, or validates it incorrectly. Nonces are the WordPress mechanism used to prove that a state-changing request originated from a legitimate user session rather than a third-party site.

Because the check is missing, any HTTP request that reaches the endpoint with an authenticated administrator's browser session cookies will be honored. The impact is limited to integrity of the compare list feature; confidentiality and availability are not affected. Attack complexity is low and no privileges are required, but user interaction is mandatory.

Root Cause

The root cause is absent or incorrect use of wp_verify_nonce() or the check_ajax_referer() guard on the add_to_compare handler. Without this verification, the plugin cannot distinguish between requests initiated by the site's own UI and requests forged by an external origin.

Attack Vector

The attack requires the target administrator or authenticated user to visit an attacker-controlled page or click a crafted link while logged into the vulnerable WordPress site. The malicious page issues a background request to the add_to_compare endpoint. The victim's browser automatically attaches the session cookies, and the plugin processes the request as if it were legitimate. No verified public exploit code has been published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-0514

Indicators of Compromise

Unexpected entries in user compare lists that were not initiated by the account owner.
Web server access logs containing requests to the add_to_compare endpoint with Referer headers from unrelated third-party domains.
Bursts of similar POST or GET requests to the compare endpoint from a single client that lacks a valid session origin.

Detection Strategies

Review HTTP request logs for calls to plugin AJAX or REST handlers that lack a valid X-WP-Nonce header or _wpnonce parameter.
Correlate administrator browsing sessions with outbound requests to unknown domains that immediately precede compare list changes.
Compare installed plugin version against 1.3.88 or later using the WordPress admin plugin inventory.

Monitoring Recommendations

Enable WordPress audit logging to capture nonce validation failures and plugin AJAX invocations.
Alert on referer mismatches for state-changing plugin endpoints originating outside the site's own domain.
Monitor for administrator accounts loading external URLs shortly before plugin state changes.

How to Mitigate CVE-2024-0514

Immediate Actions Required

Update the Royal Elementor Addons and Templates plugin to version 1.3.88 or later on all WordPress installations.
Audit administrator accounts and revoke sessions after applying the update.
Review the WordPress Plugin Changeset to confirm the fix applied to your environment.

Patch Information

The vendor released version 1.3.88 which adds proper nonce validation to the add_to_compare function. Site owners should apply the update through the WordPress plugin manager or via WP-CLI. Confirm the version by checking the plugin listing in wp-admin/plugins.php after the update completes.

Workarounds

Temporarily disable the Royal Elementor Addons and Templates plugin if immediate patching is not feasible.
Restrict administrator browsing sessions to trusted sites and require re-authentication for sensitive actions.
Deploy a web application firewall rule that blocks requests to the add_to_compare endpoint lacking a valid same-origin referer and nonce parameter.

bash

# Update the plugin using WP-CLI
wp plugin update royal-elementor-addons --version=1.3.88
wp plugin get royal-elementor-addons --field=version