The Royal Elementor Addons and Templates plugin for WordPress contains a CSRF vulnerability due to improper nonce validation in the wpr_update_form_action_meta function. This flaw allows unauthenticated attackers to post metadata by tricking site administrators into performing actions such as clicking malicious links. The vulnerability affects all versions up to 1.3.87 and is classified under CWE-352. It has a CVSS 3.1 base score of 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No patch or official vendor advisory is currently available, and no known exploits have been reported.

An attacker can exploit this vulnerability to cause an authenticated site administrator to unknowingly submit forged requests that modify metadata on the affected WordPress site. This results in limited integrity impact without affecting confidentiality or availability. Since the attack requires user interaction (clicking a crafted link) and targets administrators, the risk is moderated but still significant for site integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when clicking links and consider limiting administrative access or using security plugins that provide CSRF protections. Monitoring vendor channels for updates is recommended.