CVE-2025-46434

Unknown Unknown - Not Provided

Missing Authorization in The Plus Addons for Elementor Pro

Publication date: 2026-01-07

Last updated on: 2026-04-29

Assigner: Patchstack

Description

Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a through < 6.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-07

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-01-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-46434

EUVD

EUVD-2026-1223

Affected Vendors & Products

Vendor	Product	Version / Range
the_plus_addons	the_plus_addons_for_elementor_pro	to 6.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authorization issue in POSIMYTH Innovation The Plus Addons for Elementor Pro. It allows attackers to exploit incorrectly configured access control security levels, potentially bypassing restrictions that should prevent unauthorized actions.

Impact Analysis

The vulnerability can impact you by allowing unauthorized users with limited privileges to perform actions they should not be able to, leading to a high integrity impact without affecting confidentiality or availability.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update The Plus Addons for Elementor Pro plugin to version 6.3.7 or later. Additionally, enabling auto-updates for the plugin can help ensure ongoing protection against this and similar vulnerabilities. [1]

Hi! I’m here to help you understand CVE-2025-46434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70