CVE-2026-84759: CWE-352 Cross-Site Request Forgery (CSRF) in Elementor Activity Log

This vulnerability, identified as CVE-2026-84759 and classified under CWE-352, affects Elementor Activity Log versions up to 2.13.1. It allows unauthenticated attackers to exploit Cross-Site Request Forgery (CSRF) to perform unauthorized actions. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.

Successful exploitation can lead to unauthorized actions performed on behalf of a user, potentially causing partial loss of confidentiality, integrity, and availability of the affected system. Since the vulnerability is exploitable without authentication and affects scope beyond the vulnerable component, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply general CSRF mitigations where possible, such as implementing additional request validation or disabling vulnerable features if feasible. Monitor official Elementor communications for updates.