The Royal Elementor Addons and Templates plugin for WordPress suffers from a CSRF vulnerability (CWE-352) in the wpr_filter_grid_posts() function caused by missing or incorrect nonce validation. This flaw enables attackers to forge requests that, when executed by an authenticated site administrator, can inject malicious scripts. The vulnerability affects all versions up to 1.7.1006 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no indication of an official patch or remediation available at this time.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized actions on behalf of a site administrator by tricking them into clicking a malicious link. This can lead to limited confidentiality and integrity impacts through injection of malicious web scripts. Availability is not affected. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links and consider implementing additional CSRF protections or monitoring for suspicious activity related to the affected plugin.