CVE-2026-84759: CWE-352 Cross-Site Request Forgery (CSRF) in Elementor Activity Log

This vulnerability is an unauthenticated CSRF flaw in Elementor Activity Log versions <= 2.13.1. It enables an attacker to trick a user into executing unwanted actions on the affected application without proper authorization. The CVSS 3.1 score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. No patch or remediation details are provided in the available data.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. Since the vulnerability is unauthenticated and requires user interaction, an attacker could cause a logged-in user to perform unintended actions within the Activity Log plugin, potentially affecting the application's state or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted content and consider implementing CSRF protections or other compensating controls if possible.