The Royal Elementor Addons and Templates plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to improper nonce validation in the add_to_wishlist function. This flaw allows an attacker to craft a forged request that, when executed by a site administrator (via user interaction such as clicking a link), can add items to the administrator's wishlist without their consent. The vulnerability affects all versions up to 1.3.87. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily on integrity with no confidentiality or availability impact. No patch or official fix has been documented in the provided data.

An attacker can cause an authenticated site administrator to unknowingly add items to their wishlist by exploiting the CSRF vulnerability. This impacts the integrity of the wishlist data but does not affect confidentiality or availability. There is no indication of privilege escalation or remote code execution. The vulnerability requires user interaction (clicking a link) and does not allow unauthenticated attackers to perform actions without tricking an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into the affected plugin. Implementing additional CSRF protections or nonce validation at the application level may help mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.