Vulnerability · Published Mar 4, 2025 · Assigned by Wordfence
CVE-2025-1639Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
High 8.8
In plain English
A high-severity missing authorization in Animation Addons for Elementor Pro from crowdyTheme. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| crowdyTheme | Animation Addons for Elementor Pro | 0 – through 1.6 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H