Xpro Elementor Addons - Pro Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Xpro Elementor Addons - Pro plugin for WordPress, affecting all versions through 1.4.9. The issue arises in the custom PHP widget, where access controls are only applied on the client side. This flaw allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows authenticated users with Contributor-level access and above to execute arbitrary code on the server, potentially leading to full site compromise.

Remediation

Users are advised to update the Xpro Elementor Addons - Pro plugin to version 1.4.10 or a newer patched version.