The Royal Elementor Addons and Templates plugin for WordPress contains a CSRF vulnerability (CWE-352) in the remove_from_wishlist function due to missing or incorrect nonce validation. This flaw allows an attacker to craft a forged request that, when executed by a site administrator (via UI interaction such as clicking a link), can remove items from that administrator's wishlist without their consent. The vulnerability affects all versions up to and including 1.3.87. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. The impact is limited to integrity loss (removal of wishlist items) without confidentiality or availability impact. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker can cause unauthorized removal of items from a user's wishlist by exploiting the CSRF vulnerability, potentially disrupting user experience or administrative operations related to wishlist management. There is no impact on confidentiality or availability. The attack requires tricking a site administrator into performing an action such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into affected versions of the plugin. Monitoring for updates from the vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.