# 🛡️ Anant Addons for Elementor <= 1.1.5 - CSRF to Arbitrary Plugin Installation
## 🧨 CVE-2025-32641
**Cross-Site Request Forgery (CSRF)** vulnerability in **anantaddons**' Anant Addons for Elementor
This issue affects versions: **from unknown through 1.1.5**
- **Base Score**: 9.6 (CRITICAL)
- **CVSS Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
---
## 🔍 Description
This vulnerability allows **unauthenticated attackers** to perform **arbitrary plugin installation** on behalf of a logged-in administrator without their knowledge.
By crafting a malicious page or form, the attacker can silently force the admin to install and activate any plugin from the WordPress repository.
---
## 💥 Impact
- ✅ Arbitrary plugin installation
- ✅ Plugin activation
- ❌ No nonce or CSRF protection
- ✅ Exploitable via a simple HTML page
- ⚠️ Requires admin to be logged in and open the malicious page
---
## 🧪 HTML Proof of Concept
```html
Anant Addons for Elementor <= 1.1.5 CSRF Exploit
Anant Addons for Elementor <= 1.1.5
CSRF to Arbitrary Plugin Installation Vulnerability
# By: Nxploited | Khaled Alenazi
# Type: CSRF (No Nonce Validation)
# Impact: Unauthenticated attacker can force admin to install and activate arbitrary WordPress plugins
```
> 🎯 When a logged-in administrator clicks this form (or it auto-submits in a malicious page), the plugin will be silently installed and activated.
---
## ⚠️ Disclaimer
This repository and content are for **educational and security research purposes only**.
The author is **not responsible** for any misuse or damage caused by improper use of this information.
Always perform testing on systems **you own or have explicit permission to test**.
---
*by: Nxploited | Khaled ALenazi*