CVE-2024-24843: PowerPack Addons for Elementor CSRF Flaw

CVE-2024-24843 Overview

CVE-2024-24843 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the PowerPack Pro for Elementor WordPress plugin. The flaw impacts all plugin versions prior to 2.10.8. An attacker who tricks an authenticated administrator into visiting a malicious page can submit forged requests that modify plugin settings. According to the Patchstack CVE Analysis, the CSRF can be chained to introduce stored Cross-Site Scripting (XSS) through altered settings. Successful exploitation leads to plugin configuration changes and script injection executed in the context of site visitors or administrators.

Critical Impact
An attacker can chain CSRF with XSS to modify plugin settings and execute arbitrary JavaScript in the WordPress admin context, enabling site takeover.

Affected Products

PowerPack Pro for Elementor versions prior to 2.10.8
WordPress sites running the PowerPack Addons for Elementor (Pro edition)
Deployments where administrators authenticate through browsers susceptible to cross-origin request forgery

Discovery Timeline

2024-02-21 - CVE-2024-24843 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-24843

Vulnerability Analysis

The vulnerability stems from missing or insufficient anti-CSRF protections on a plugin settings handler. Authenticated WordPress administrators can have state-changing requests forged by an attacker-controlled page. Because the plugin does not adequately validate request origin or nonce tokens, the server processes the forged request as legitimate administrator action. The Patchstack advisory describes the impact as CSRF leading to plugin settings change and stored XSS. Stored XSS in an Elementor add-on extends the blast radius to every page rendered by the affected site. Attackers can implant persistent JavaScript that harvests session cookies, escalates privileges, or pivots to additional WordPress administration endpoints.

Root Cause

The root cause is the absence of proper request authenticity verification on settings-modification endpoints exposed by PowerPack Pro for Elementor. WordPress provides wp_nonce_field() and check_admin_referer() primitives for this purpose, but the affected code paths did not enforce them correctly. Without a valid nonce check, the browser of an authenticated administrator becomes a confused deputy that submits attacker-supplied parameters.

Attack Vector

Exploitation requires a logged-in administrator to load an attacker-controlled web page or click a crafted link. The malicious page issues an automatic POST or GET request to the vulnerable plugin endpoint using the administrator's authenticated session. Because the plugin trusts the authenticated session without origin verification, the forged request updates plugin settings. The attacker injects HTML or JavaScript payloads into settings fields that are later rendered without sufficient output encoding. The injected script then executes in administrator or visitor browsers, completing the CSRF-to-XSS chain.

No public proof-of-concept code is currently available. Refer to the Patchstack CVE Analysis for additional technical context.

Detection Methods for CVE-2024-24843

Indicators of Compromise

Unexpected modifications to PowerPack Pro for Elementor plugin settings in wp_options or related tables
Presence of <script> tags, event handlers, or obfuscated JavaScript inside plugin configuration values
Outbound HTTP requests from rendered pages to unfamiliar third-party domains
WordPress admin sessions originating from unusual referrers or geographic locations

Detection Strategies

Audit WordPress access logs for POST requests to PowerPack admin endpoints lacking a same-origin Referer header
Compare current plugin settings against a known-good baseline to identify unauthorized changes
Scan rendered HTML output and database settings tables for injected script content
Review browser console errors and Content Security Policy reports for unexpected script execution

Monitoring Recommendations

Enable WordPress audit logging to capture administrator setting changes with user and IP attribution
Forward web server and PHP error logs to a centralized analytics platform for correlation
Alert on administrator account activity outside normal business hours or from new IP ranges
Monitor file integrity for the wp-content/plugins/powerpack-elements/ directory

How to Mitigate CVE-2024-24843

Immediate Actions Required

Upgrade PowerPack Pro for Elementor to version 2.10.8 or later on all WordPress installations
Rotate administrator credentials and invalidate active WordPress sessions after patching
Review plugin settings for unauthorized changes and remove any injected script content
Restrict WordPress admin access by IP allowlist or VPN where operationally feasible

Patch Information

The vendor addressed the issue in PowerPack Pro for Elementor version 2.10.8. The fix introduces proper nonce verification on the affected settings handlers, ensuring requests originate from authorized admin pages. Site operators should apply the update through the WordPress plugin updater or by downloading the patched release from the vendor portal. Verify the installed version via the WordPress admin Plugins screen after deployment.

Workarounds

Deploy a Web Application Firewall (WAF) rule that requires a same-origin Referer header for requests to plugin admin endpoints
Restrict administrator browsing habits and require dedicated browsers or profiles for WordPress administration
Apply a strict Content Security Policy (CSP) that blocks inline scripts and unauthorized external script sources
Temporarily deactivate the plugin if patching cannot be performed within the required maintenance window

bash

# Verify installed plugin version using WP-CLI
wp plugin get powerpack-elements --field=version

# Update PowerPack Pro for Elementor to the patched release
wp plugin update powerpack-elements --version=2.10.8

# Confirm the upgrade succeeded
wp plugin list --name=powerpack-elements --format=table