Animation Addons for Elementor Pro Missing Authorization Vulnerability Allows Arbitrary Plugin Installation

A vulnerability exists in the Animation Addons for Elementor Pro plugin for WordPress, in all versions through 1.6. The issue arises from a lack of proper capability checks in the install_elementor_plugin_handler() function, allowing authenticated attackers with Subscriber-level access or higher to install and activate arbitrary plugins. This could be exploited to further compromise a site, particularly when Elementor is not active on a vulnerable installation.

Impact

Exploitation of this vulnerability could lead to unauthorized installation and activation of plugins, potentially allowing for malicious actions to be performed on the site.

Remediation

Users are advised to update the Animation Addons for Elementor Pro plugin to version 1.7 or a newer patched version.