CVE-2025-31413: 
WordPress vulnerability analysis and mitigation

CVE-2025-31413 is a Cross-Site Request Forgery (CSRF) vulnerability in the bdthemes Element Pack Elementor Addons plugin (bdthemes-element-pack-lite) for WordPress. It affects all versions through 8.3.13 and was published on January 22, 2026, with Patchstack as the reporting CNA. The vulnerability was initially scored at CVSS 3.1 8.8 (High) by CISA-ADP, but Patchstack subsequently revised the score to 4.3 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, reflecting a more limited integrity-only impact (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), arising from insufficient or absent nonce/token verification on state-changing requests within the Element Pack Elementor Addons plugin. An attacker can craft a malicious web page that, when visited by an authenticated WordPress user, silently submits forged requests to the WordPress site on the victim's behalf. No privileges are required by the attacker, but user interaction (the victim visiting the attacker-controlled page while logged in) is a prerequisite for exploitation (Patchstack).

Successful exploitation allows an attacker to perform unauthorized actions on behalf of an authenticated WordPress user, such as modifying plugin settings or site content. Per Patchstack's revised assessment, the primary impact is limited integrity compromise (e.g., unauthorized content or configuration changes), with no direct confidentiality or availability impact. The practical severity depends on the privilege level of the victim user — exploitation against an administrator account could result in more significant site-wide changes (Patchstack).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000080, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify WordPress sites running the bdthemes Element Pack Elementor Addons plugin (version ≤ 8.3.13), using tools like WPScan or by inspecting publicly visible plugin metadata.
2. Craft malicious page: Create an attacker-controlled web page containing a hidden HTML form or JavaScript that automatically submits a forged HTTP request targeting a vulnerable state-changing action within the Element Pack plugin on the victim's WordPress site.
3. Social engineering: Deliver the malicious page link to an authenticated WordPress administrator or privileged user via phishing email, social media, or other channels.
4. Trigger forged request: When the victim visits the malicious page while logged into their WordPress site, the browser automatically sends the forged request with the victim's session cookies, causing the plugin to execute the unauthorized action (e.g., modifying plugin settings or site content) without the victim's knowledge (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to Element Pack plugin endpoints originating from unusual referrer URLs or external domains.
• File System / Database: Unexpected changes to plugin settings or WordPress site configuration that do not correspond to known administrator activity.
• Logs: WordPress audit logs (if enabled via a security plugin) recording administrative actions performed at unusual times or from unexpected IP addresses.

Site owners should update the bdthemes Element Pack Elementor Addons plugin to a version newer than 8.3.13 as soon as a patched release is available. As an interim measure, consider temporarily disabling the plugin if it is not critical to site operations. Administrators should be educated about CSRF risks and advised not to click suspicious links while logged into WordPress. Implementing SameSite=Strict or SameSite=Lax cookie attributes at the server level can also reduce CSRF exposure (Patchstack).