CVE-2025-0393: Royal Elementor Addons CSRF Vulnerability

CVE-2025-0393 Overview

CVE-2025-0393 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Royal Elementor Addons and Templates plugin for WordPress. The flaw exists in all versions up to and including 1.7.1006. The root cause is missing or incorrect nonce validation on the wpr_filter_grid_posts() function. Unauthenticated attackers can inject malicious web scripts by tricking a site administrator into clicking a crafted link. Successful exploitation results in script injection in the context of the targeted administrator session. The vulnerability is tracked under CWE-352 and was published to the National Vulnerability Database (NVD) on January 14, 2025.

Critical Impact
Unauthenticated attackers can inject malicious scripts into WordPress sites running vulnerable versions of Royal Elementor Addons by tricking administrators into clicking forged request links.

Affected Products

Royal Elementor Addons and Templates plugin for WordPress
All versions up to and including 1.7.1006
WordPress sites using the royal-elementor-addons component

Discovery Timeline

2025-01-14 - CVE-2025-0393 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0393

Vulnerability Analysis

The vulnerability resides in the wpr_filter_grid_posts() function within the plugin's filter grid posts module. WordPress relies on nonce tokens to validate that state-changing requests originate from legitimate user sessions. When nonce validation is absent or improperly implemented, an attacker can craft a request that a victim's browser submits automatically. In this case, the plugin fails to verify a valid nonce before processing the filter grid posts action. This allows attacker-controlled data to reach a sink that renders scripts in the administrator context. The impact combines CSRF with script injection, enabling stored or reflected script execution against site administrators.

Root Cause

The root cause is missing or incorrect nonce validation in wpr_filter_grid_posts(). WordPress plugins are expected to call check_ajax_referer() or wp_verify_nonce() before executing sensitive operations. The affected function in the vulnerable source file at classes/modules/wpr-filter-grid-posts.php processes requests without adequate CSRF token verification, breaking the intended trust boundary between authenticated administrator actions and third-party origins.

Attack Vector

Exploitation requires user interaction. An unauthenticated attacker hosts or delivers a crafted link, form, or embedded resource. When an authenticated site administrator visits the attacker-controlled page or clicks the link, the victim's browser issues the forged request to the target WordPress site with valid session cookies. The plugin processes the request and returns attacker-supplied content that executes as script in the administrator's browser session. Because the scope is changed (S:C) and user interaction is required, the vulnerability is well suited to targeted phishing against WordPress administrators. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet for source-level context.

Detection Methods for CVE-2025-0393

Indicators of Compromise

Unexpected outbound requests from administrator browsers to unfamiliar domains shortly before or after visits to the WordPress admin dashboard.
Web server access logs showing requests to admin-ajax.php invoking the wpr_filter_grid_posts action from unusual Referer headers or with missing nonce parameters.
Newly created administrator accounts, modified plugin or theme files, or injected <script> tags in post content or widget areas.

Detection Strategies

Inventory all WordPress installations and identify sites running Royal Elementor Addons at or below version 1.7.1006.
Inspect HTTP request logs for calls to the wpr_filter_grid_posts endpoint that lack a valid _wpnonce value or originate from cross-origin Referer headers.
Deploy a Web Application Firewall (WAF) rule to flag requests targeting the affected endpoint with anomalous parameters or script payloads.

Monitoring Recommendations

Enable WordPress audit logging to capture administrator actions, plugin changes, and user privilege modifications.
Correlate browser-side telemetry with server logs to identify administrators who visited external pages immediately before triggering admin actions.
Alert on modifications to WordPress core files, plugin directories, and the wp_options table that occur outside of scheduled maintenance windows.

How to Mitigate CVE-2025-0393

Immediate Actions Required

Update the Royal Elementor Addons and Templates plugin to a version later than 1.7.1006 that includes the fix from WordPress Changeset 3220959.
Audit administrator accounts for unauthorized changes, injected scripts, and unexpected new users after confirming vulnerable versions were installed.
Require administrators to log out of the WordPress dashboard when browsing untrusted sites and enforce session isolation using separate browsers or profiles.

Patch Information

The vendor addressed the issue in the plugin update referenced by WordPress Changeset 3220959. The fix adds nonce validation to the wpr_filter_grid_posts() function. Administrators should update through the WordPress plugin manager or manually replace the plugin files with a patched release. Additional developer information is available on the WordPress Plugin Developer Info page.

Workarounds

Disable and remove the Royal Elementor Addons plugin until the site can be updated to a patched version.
Restrict administrator access using IP allowlisting on /wp-admin/ and admin-ajax.php to reduce the exposure of forged requests.
Deploy a WAF rule that blocks requests to the wpr_filter_grid_posts action lacking a valid _wpnonce parameter or containing script-like payloads.

bash

# Example: block unauthenticated requests to the vulnerable endpoint via WAF pattern
# ModSecurity rule (adjust IDs and paths to your environment)
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1000393,msg:'Block CVE-2025-0393 CSRF attempt'"
  SecRule ARGS:action "@streq wpr_filter_grid_posts" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"