Executive brief
The Vertex Addons for Elementor plugin for WordPress, which provides additional design elements for the Elementor page builder, contains a security flaw that allows unauthorized users to install and activate other plugins. Even low-level users, such as subscribers, can exploit this to modify the website's functionality. This could lead to a full site takeover if an attacker installs a plugin with further vulnerabilities or administrative capabilities.
Technical details
The vulnerability exists in the activate_required_plugins() function within the app/Ajax.php file due to missing authorization. While the code includes a current_user_can('install_plugins') check, it fails to terminate execution (e.g., via wp_die() or return) if the check fails. Instead, it merely populates an error variable and continues to execute the installation and activation logic. This allows an authenticated attacker with Subscriber-level permissions or higher to trigger the installation and activation of arbitrary plugins from the WordPress repository via an AJAX request. A patch was introduced in version 1.6.5.
Affected products
- webilia Vertex Addons for Elementor up to and including 1.6.4
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
References
- https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/tags/1.6.4/app/Ajax.php
- https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/tags/1.6.4/app/Ajax.php
- https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/tags/1.6.4/app/Ajax.php
- https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/tags/1.6.4/app/Ajax.php
- https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/trunk/app/Ajax.php
- https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/trunk/app/Ajax.php
- https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/trunk/app/Ajax.php