CVE-2025-5938: Elementor Templates Addons CSRF Vulnerability

CVE-2025-5938 Overview

CVE-2025-5938 is a Cross-Site Request Forgery (CSRF) vulnerability in the Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 1.1.1. The import_templates() function lacks proper nonce validation, allowing unauthenticated attackers to trigger template imports through forged requests. Exploitation requires an administrator to be tricked into clicking a malicious link or visiting an attacker-controlled page. The vulnerability is tracked as [CWE-352] and impacts sites running the plugin developed by Themebon.

Critical Impact
Unauthenticated attackers can force administrators to import arbitrary templates, potentially introducing unwanted content or altering site state without consent.

Affected Products

Themebon Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress
All versions up to and including 1.1.1
WordPress sites using the vulnerable plugin with Elementor

Discovery Timeline

2025-06-13 - CVE-2025-5938 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5938

Vulnerability Analysis

The vulnerability exists in the import_templates() function of the Digital Marketing and Agency Templates Addons for Elementor plugin. WordPress plugins are expected to validate nonces on state-changing requests using functions such as check_admin_referer() or wp_verify_nonce(). The affected function omits or incorrectly implements this validation. As a result, requests to the import endpoint are accepted without verifying that they originated from a legitimate user session.

An attacker can craft a malicious page containing a hidden form or JavaScript that submits a request to the vulnerable endpoint. When an authenticated administrator visits the page, the browser automatically attaches session cookies. The plugin processes the import action as if the administrator initiated it.

Root Cause

The root cause is missing or incorrect nonce validation on the import_templates() function, classified as [CWE-352] Cross-Site Request Forgery. The handler does not confirm request authenticity before processing the import operation.

Attack Vector

The attack requires network access and user interaction. An attacker hosts a malicious page or embeds a payload in a link sent to an administrator via phishing. Upon interaction, the administrator's browser issues the forged request to the WordPress site, invoking the template import routine with administrator privileges. Refer to the WordPress Template Importer Code and the Wordfence Vulnerability Advisory for technical details.

Detection Methods for CVE-2025-5938

Indicators of Compromise

Unexpected template entries in the WordPress database or Elementor library.
Access log entries showing POST requests to the plugin's import endpoint originating from external Referer headers.
Administrator sessions performing import actions without a corresponding admin dashboard navigation trail.

Detection Strategies

Inspect web server logs for requests targeting the plugin's import_templates handler with off-site referers.
Audit the WordPress wp_posts and Elementor template tables for recently created entries authored by administrator accounts.
Correlate administrator browser activity with import events to identify actions triggered by external links.

Monitoring Recommendations

Enable request logging for /wp-admin/admin-ajax.php and plugin-specific endpoints.
Alert on POST requests to plugin endpoints that lack a valid same-origin Referer header.
Monitor for administrator account activity outside of expected work hours or workflows.

How to Mitigate CVE-2025-5938

Immediate Actions Required

Update the Digital Marketing and Agency Templates Addons for Elementor plugin to a version above 1.1.1 once a patched release is available.
Deactivate the plugin on affected WordPress sites until a fix is confirmed.
Instruct administrators to log out of WordPress before browsing untrusted links.

Patch Information

At the time of publication, no fixed version is listed in the enriched data. Review the Wordfence Vulnerability Advisory for the latest remediation guidance from the vendor.

Workarounds

Restrict WordPress administrator access to a dedicated browser profile that is not used for general web browsing.
Deploy a Web Application Firewall (WAF) rule that blocks requests to the plugin's import endpoint when the Referer header is missing or points to an external domain.
Enforce two-factor authentication and short session lifetimes for administrator accounts to reduce the exposure window.

bash

# Configuration example: WAF rule to block cross-origin POST to plugin import endpoint
SecRule REQUEST_METHOD "@streq POST" "chain,deny,status:403,id:1005938,msg:'Block CSRF to vulnerable Elementor addon import'"
  SecRule REQUEST_URI "@contains import_templates" "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example"