CVE-2023-52150 is a high severity (8.8 CVSS) cross-site request forgery flaw in the Dynamic Content for Elementor plugin for WordPress, in versions before 2.12.5. Patchstack says it can lead to arbitrary changes to WordPress options. Update to 2.12.5 or later, and check your site settings afterwards.
What's affected
The NVD record covers Dynamic Content for Elementor from Ovation S.R.L., all versions before 2.12.5. Patchstack lists versions below 2.12.5 as vulnerable and 2.12.5 as the patched release, so the two sources agree.
The weakness is CWE-352 (Cross-Site Request Forgery). The Patchstack advisory title adds the consequence: the forged request leads to an arbitrary WordPress options change. WordPress stores site wide settings in a table of options, and a few of those options control who can register and what role new users receive.
The vector in the record is network based, needs no privileges and requires user interaction, with high impact on confidentiality, integrity and availability.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get dynamic-content-for-elementor --field=version
The slug dynamic-content-for-elementor comes from the Patchstack advisory address, so confirm it matches the folder under wp-content/plugins on your site. Any version below 2.12.5 is in the affected range. The Plugins screen in the dashboard shows the same version number.
Also check for signs that options were altered. Look at general settings, the default role for new users and whether open registration is on:
wp option get users_can_register
wp option get default_role
wp option get admin_email
If any of these values surprise you, treat it as a sign that something changed them and look further.
What to do now
- Back up the site and its database before changing anything.
- Update Dynamic Content for Elementor to 2.12.5 or later, from the dashboard or with
wp plugin update dynamic-content-for-elementor. - Compare the options listed above with what you expect, and fix anything that is wrong.
- List administrator accounts and remove any you did not create:
wp user list --role=administrator --fields=ID,user_login,user_registered
- Ask admins to sign out of WordPress when they are not working, and to avoid browsing unrelated sites in the same browser profile.
- If you see unexplained changes, rotate administrator passwords and review the site's file and plugin list for additions.
Why it matters
CSRF is easy to underestimate because the attacker never sees the site. The attacker only needs a signed-in admin's browser to send a request while a session is active. The missing control is a per-request token, which WordPress offers as a nonce.
The interesting part of this entry is the target. Most CSRF flaws touch one plugin setting. A forged request that can change arbitrary WordPress options touches the core of the site. Changing the registration setting and the default role is a well known route for a site takeover in general, and we mention it so you know which values to check, not as a description of how an attack here works. The advisory does not give those details.
Sources differ on how worried to be. The record scores this 8.8, which is high, and Patchstack labels it low priority and unlikely to be exploited. The score reflects what a successful forged request could do, and the label reflects the effort needed to trigger it. For a site with unreviewed admin accounts, treat it as a high priority fix. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
For a wider view of your own code, the free in-browser dependency scan and the Gold directory show which packages carry known CVEs, and reachability analysis helps you decide which findings to fix first. WordPress plugins installed from the admin screen do not sit in a manifest, so start with the wp-cli inventory above for those.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can a visitor change my settings without logging in?
Not directly. The request has to ride on a signed-in privileged user's session, so the attacker must get that user to load a hostile page or link. That is why logging out and using a separate browser profile help.
Why does Patchstack say low priority when the score is 8.8?
Patchstack ranks how likely an attack is in practice, and the CVSS score ranks the possible damage. They answer different questions. The update is quick, so close the gap by updating.
Sources
Last reviewed: 19 October 2026.
