CVE-2026-25398: 
WordPress vulnerability analysis and mitigation

CVE-2026-25398 is a Missing Authorization vulnerability in the Vertex Addons for Elementor WordPress plugin developed by Webilia Inc. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin from n/a through 1.6.4. It was published on March 25, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. The attack vector is network-based, requires low privileges (authenticated user), no user interaction, and low attack complexity. An attacker with a basic WordPress account can send crafted requests to restricted plugin endpoints that lack proper capability checks, thereby performing actions beyond their intended authorization level (Feedly).

Successful exploitation results in a high integrity impact with no confidentiality or availability impact, meaning an attacker can modify data or perform unauthorized actions within the WordPress site without being able to read sensitive data or disrupt availability. The scope is unchanged, limiting the impact to the affected plugin's context. This could allow a low-privileged user (e.g., a subscriber or contributor) to manipulate plugin settings, content, or configurations that should be restricted to administrators (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was assigned and disclosed by Patchstack (Feedly).

Users should update the Vertex Addons for Elementor plugin to a version beyond 1.6.4 that includes the authorization fix. If no patched version is yet available, site administrators should consider deactivating the plugin until a fix is released, or restrict access to the WordPress site to trusted users only. Monitoring WordPress user activity logs for unexpected actions by low-privileged accounts is also advisable (Patchstack).