The Ultimate Store Kit Elementor Addons plugin for WordPress versions up to 2.4.1 suffers from a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation in the dismiss() function. This allows unauthenticated attackers to forge requests that set user meta values to '1', which can be used to lock out site administrators if they are tricked into clicking a malicious link. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only. No patch or official fix is currently available from the vendor or other sources.

An attacker can exploit this CSRF vulnerability to set arbitrary user meta values to '1' without authentication by tricking an administrator into clicking a crafted link. This can result in locking the administrator out of the WordPress site, impacting site management and control. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links while logged into the affected plugin. Monitoring vendor channels for updates is recommended. No official patch or workaround is currently documented.