The Royal Elementor Addons and Templates plugin for WordPress contains a CSRF vulnerability due to improper nonce validation on the remove_from_compare function. This flaw enables attackers to perform unauthorized state-changing actions (removing items from compare lists) by convincing an authenticated site administrator to execute a malicious request. The vulnerability affects all plugin versions up to and including 1.3.87. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

An attacker can cause an authenticated site administrator to unknowingly remove items from user compare lists by exploiting the CSRF vulnerability. This results in limited integrity impact without affecting confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should exercise caution when clicking on untrusted links and consider implementing additional CSRF protections or disabling the vulnerable functionality if possible.