CVE-2025-46434: 
WordPress vulnerability analysis and mitigation

CVE-2025-46434 is a Missing Authorization (Broken Access Control) vulnerability in the POSIMYTH Innovation "The Plus Addons for Elementor Pro" WordPress plugin. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels, potentially performing higher-privileged actions. The vulnerability affects all versions of the plugin prior to 6.3.7. It was reported by Rafie Muhammad on December 13, 2024, and publicly disclosed by Patchstack on January 7, 2026. The CVSS v3.1 base score is 6.5 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged functions — specifically, it lacks adequate authorization, authentication, or nonce token checks. This allows a low-privileged authenticated user (e.g., a Subscriber) to invoke functionality intended for higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit once an attacker has any authenticated session on the target WordPress site. The vulnerability is categorized under OWASP Top 10 A1: Broken Access Control (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized actions that should be restricted to higher-privileged users, resulting in a high integrity impact with no confidentiality or availability impact. This could enable unauthorized modification of site content, settings, or plugin configurations managed by The Plus Addons for Elementor Pro. The scope is limited to the affected WordPress installation, but in multi-tenant or high-traffic environments, this could be leveraged in mass-exploit campaigns targeting many sites simultaneously (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. Patchstack rates this as low priority with "no impactful threat," though it notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running The Plus Addons for Elementor Pro plugin versions below 6.3.7 using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Obtain low-privilege access: Register or obtain credentials for a Subscriber-level (or equivalent low-privilege) account on the target WordPress site.
3. Identify unprotected endpoints: Enumerate plugin-registered AJAX actions, REST API endpoints, or admin-ajax.php handlers associated with the plugin that lack proper capability checks or nonce validation.
4. Send unauthorized request: Craft and send an authenticated HTTP request (e.g., POST to wp-admin/admin-ajax.php with the relevant action parameter) to invoke a privileged function without the required authorization checks.
5. Achieve unauthorized action: Successfully execute a higher-privileged operation — such as modifying plugin settings, page content, or other site configurations — that should be restricted to Editor, Administrator, or other elevated roles (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the theplus_elementor_addon plugin from Subscriber-level user accounts, particularly for actions not normally performed by low-privilege users.
• Logs: Unexpected changes to plugin settings, page content, or Elementor template configurations logged in WordPress activity/audit logs (if enabled via plugins like WP Activity Log).
• File System: Unexpected modifications to Elementor page templates or plugin configuration files coinciding with low-privilege user activity.
• Network: Repeated or scripted authenticated requests to plugin-specific AJAX endpoints from the same IP address or user account in a short time window, potentially indicating automated exploitation attempts.

The vendor has released version 6.3.7 of The Plus Addons for Elementor Pro, which patches this vulnerability. Site administrators should update the plugin to version 6.3.7 or later immediately. If an immediate update is not possible, consider restricting new user registrations or limiting Subscriber-level account creation until the patch can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).