CVE-2024-0515 Overview
CVE-2024-0515 is a Cross-Site Request Forgery (CSRF) vulnerability in the Royal Elementor Addons and Templates plugin for WordPress. The flaw affects all versions up to and including 1.3.87. It stems from missing or incorrect nonce validation on the remove_from_compare function. Unauthenticated attackers can remove items from user compare lists by tricking a site administrator into clicking a crafted link. The issue is tracked under CWE-352 and was fixed in version 1.3.88.
Critical Impact
Attackers can forge requests that remove items from WordPress compare lists when an authenticated administrator interacts with a malicious link, affecting integrity of user-facing compare functionality.
Affected Products
- Royal Elementor Addons and Templates plugin for WordPress
- All versions up to and including 1.3.87
- WordPress sites where an administrator can be socially engineered into clicking attacker-controlled links
Discovery Timeline
- 2024-02-29 - CVE-2024-0515 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0515
Vulnerability Analysis
The vulnerability exists in the remove_from_compare function of the Royal Elementor Addons and Templates plugin. WordPress uses nonces (numbers used once) to validate that a request originates from a legitimate user session. The plugin either omits nonce checks or implements them incorrectly on this function. As a result, the server cannot distinguish between a request initiated by the site administrator and one initiated by an attacker through a third-party page. This condition satisfies the definition of Cross-Site Request Forgery under CWE-352.
Root Cause
The root cause is the absence of proper wp_verify_nonce() validation on the remove_from_compare handler. Without a valid, request-bound token, the endpoint accepts any request that carries the administrator's authentication cookies. Browsers automatically attach these cookies when the user visits an attacker-controlled page. Details are documented in the Wordfence Vulnerability Report.
Attack Vector
Exploitation requires user interaction. An attacker crafts a page that issues a request to the vulnerable endpoint on the target WordPress site. When an authenticated administrator visits that page, the browser sends the request with valid session cookies. The server executes the remove_from_compare action, removing items from compare lists. The attack does not require prior authentication on the target site but does depend on tricking a privileged user into clicking a link. The upstream patch is visible in the WordPress Plugin Change Log.
No verified public exploit code is available. The vulnerability class is well understood: a malicious HTML page hosting an auto-submitting form or image tag pointed at the vulnerable admin-ajax endpoint is sufficient to trigger the action when an administrator loads it.
Detection Methods for CVE-2024-0515
Indicators of Compromise
- Requests to admin-ajax.php invoking the remove_from_compare action with a missing, malformed, or reused _wpnonce parameter
- HTTP Referer headers on state-changing plugin requests that point to external, untrusted domains
- Unexpected modifications to user compare lists that do not correlate with administrator activity in access logs
Detection Strategies
- Inspect web server access logs for POST requests to plugin AJAX handlers that lack a valid nonce query parameter
- Correlate administrator browser activity with plugin state changes to identify actions triggered from off-site pages
- Deploy a Web Application Firewall (WAF) rule that flags requests to the remove_from_compare action originating with cross-origin Referer values
Monitoring Recommendations
- Monitor the installed version of the Royal Elementor Addons plugin across all managed WordPress instances and alert when the version is 1.3.87 or earlier
- Track anomalous administrator session activity, especially state-changing requests immediately following navigation to external URLs
- Log and review changes to plugin data tables so that unauthorized modifications to compare lists can be reconstructed
How to Mitigate CVE-2024-0515
Immediate Actions Required
- Upgrade the Royal Elementor Addons and Templates plugin to version 1.3.88 or later on every WordPress instance
- Audit administrator accounts for unnecessary privileges and enforce least-privilege role assignments
- Instruct administrators to log out of WordPress sessions before browsing untrusted sites and to avoid clicking unsolicited links
Patch Information
The vendor released version 1.3.88 of the Royal Elementor Addons and Templates plugin, which adds nonce validation to the affected handler. The code change is available in the WordPress Plugin Change Log. Additional technical context is provided in the Wordfence Vulnerability Report.
Workarounds
- Deploy a WAF rule that blocks requests to the remove_from_compare action lacking a valid _wpnonce parameter until patching is complete
- Set the WordPress session cookie SameSite attribute to Lax or Strict at the reverse proxy to reduce cross-site request risk
- Restrict administrator access to a dedicated browser profile or workstation not used for general web browsing
# Update the plugin via WP-CLI to the patched version
wp plugin update royal-elementor-addons --version=1.3.88
# Verify the installed version across a multisite network
wp plugin get royal-elementor-addons --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
