The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress contains a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation in the ajax_plugin_activation function. This flaw allows unauthenticated attackers to activate arbitrary installed plugins by tricking a site administrator into executing a forged request. The vulnerability affects all versions up to 1.4.4. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

An attacker can cause a site administrator to unknowingly activate arbitrary installed plugins via a forged request, which could lead to unauthorized changes in the WordPress environment. The vulnerability does not directly impact confidentiality or availability but can affect integrity by enabling unauthorized plugin activation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with plugin activation requests and avoid clicking untrusted links while logged in as an administrator. Monitoring for updates from envothemes is recommended to apply any forthcoming patches promptly.