The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to improper or missing nonce validation in the import_templates() function. This flaw enables an attacker to craft a forged request that, when executed by an authenticated site administrator, triggers an import operation without proper authorization. The vulnerability affects all plugin versions up to and including 1.1.1. The CVSS 3.1 base score is 5.3, reflecting a medium severity impact primarily on integrity, with no confidentiality or availability impact. There is no indication of known exploits in the wild or an available patch at this time.

An attacker can exploit this vulnerability to cause an authenticated site administrator to unknowingly trigger the import of templates via a forged request. This could lead to unauthorized modifications of the site’s content or configuration through the import process. The impact is limited to integrity as no confidentiality or availability impacts are indicated. Exploitation requires social engineering to trick an administrator into performing the action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with links or requests that could trigger plugin functions. Monitoring for updates from the vendor or plugin repository is recommended to apply any forthcoming patches promptly.