A critical authorization flaw in the Vertex Addons for Elementor plugin allows low-privileged users to achieve remote code execution by installing and activating arbitrary malicious plugins.

This vulnerability is a Missing Authorization flaw (CWE-862) located in the activate_required_plugins() function. The plugin fails to terminate execution when a capability check fails, allowing authenticated attackers with Subscriber-level access to perform unauthorized plugin installations.

The ability for a low-privileged user to install and activate arbitrary plugins poses a severe risk to the entire WordPress environment. An attacker could leverage this capability to install malicious software, leading to full site compromise, data exfiltration, or complete system takeover. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized administrative actions.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the Vertex Addons for Elementor plugin until a secure update is provided by the vendor.

Proactive Monitoring: Review WordPress administrative logs for unexpected plugin installations or activations, particularly those performed by accounts with Subscriber or lower-level privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized requests to the plugin's Ajax endpoints, specifically targeting the activate_required_plugins() logic.

Public Exploit Available: Unknown

The vulnerability presents a significant risk to site integrity and security. Because the flaw allows for the escalation of privileges through arbitrary plugin installation, it is imperative that organizations prioritize the removal of this plugin. Administrators must monitor for unauthorized changes and remain vigilant for security patches from the vendor.