The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to improper nonce validation in the ajax_theme_activation function. This flaw allows an attacker to craft a malicious request that, if executed by an authenticated site administrator, could activate arbitrary installed themes without their explicit consent. The vulnerability affects all versions up to 1.4.4. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, no privileges required, but requiring user interaction. There is no indication of a patch or official fix at this time.

An attacker can cause an authenticated site administrator to unknowingly activate arbitrary installed themes by exploiting the CSRF vulnerability. This could lead to integrity issues on the affected WordPress site by changing the active theme without administrator intent. There is no direct impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links while logged into the WordPress admin interface. Implementing additional CSRF protections or disabling ajax_theme_activation functionality if possible may reduce risk.