CVE-2026-28164: CWE-352 Cross-Site Request Forgery (CSRF) in HashThemes Easy Elementor Addons

This vulnerability is a Cross-Site Request Forgery (CWE-352) in the Easy Elementor Addons plugin by HashThemes. It affects all versions up to 2.3.7 and enables attackers to trick authenticated users into submitting unwanted requests, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 score of 9.6 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed with high impact on confidentiality, integrity, and availability.

Successful exploitation of this CSRF vulnerability could allow attackers to perform unauthorized actions with the privileges of the victim user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The critical CVSS score (9.6) indicates severe impact if exploited.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or limiting use of the affected plugin and apply any recommended temporary mitigations from the vendor.