CVE-2025-1639
Published: 04 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-1639 is a vulnerability in the Animation Addons for Elementor Pro plugin for WordPress that allows unauthorized arbitrary plugin installation due to a missing capability check in the install_elementor_plugin_handler() function. It affects all versions up to and including 1.6. The issue is classified under CWE-862 (Missing Authorization) with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By calling the vulnerable function, they can install and activate arbitrary plugins, enabling further compromise of the site, such as backdoor deployment or escalation, even on sites where Elementor is not activated.
Mitigation details are available in advisories referenced by the CVE, including Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/fb310bdb-fc74-47b2-9371-3d10abd287fb?source=cve and the plugin's ThemeForest page at https://themeforest.net/item/arolax-creative-digital-agency-theme/53547630. Security practitioners should update to a patched version beyond 1.6 and review access controls for low-privilege users.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability allows authenticated low-privilege (Subscriber) users to bypass authorization and install arbitrary plugins on a public-facing WordPress site, directly enabling exploitation of the application (T1190) for privilege escalation (T1068) to achieve backdoor deployment or further compromise.