CVE-2025-67540: 
WordPress vulnerability analysis and mitigation

CVE-2025-67540 is a Missing Authorization vulnerability in the Animation Addons for Elementor WordPress plugin by Wealcoder, classified as an Arbitrary Content Deletion flaw. It affects all versions up to and including 2.4.5, and was reported by security researcher Denver Jackson on November 25, 2025, with public disclosure on December 9–15, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The root cause is a Missing Authorization check (CWE-862), mapped to OWASP Top 10 A1: Broken Access Control. The plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing content deletion operations, enabling low-privileged users (Contributor/Developer level) to delete arbitrary site content such as posts, pages, or media. Exploitation requires network access and a low-privilege authenticated account, with no user interaction required (Patchstack).

Successful exploitation allows an authenticated low-privileged attacker to delete arbitrary content from the WordPress site, including posts, pages, and images, resulting in a high integrity impact. There is no confidentiality or availability impact as defined by the CVSS scoring. While not enabling remote code execution or data exfiltration, content deletion can cause significant operational disruption and reputational damage to affected WordPress sites (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.038%, indicating a very low probability of exploitation in the near term. Patchstack rates this as low priority, noting it is unlikely to be exploited, though they acknowledge that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The vulnerability is patched in Animation Addons for Elementor version 2.4.6. Site administrators should update the plugin immediately via the WordPress dashboard or by downloading the latest version from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor-level user accounts or temporarily deactivating the plugin is advisable (Patchstack).