PT-2025-31504 · WordPress+1 · Absolute Addons For Elementor+1

Wesley · Published 2025-07-31 · Updated 2025-07-31 · CVE-2025-8068

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HT Mega – Absolute Addons For Elementor plugin for WordPress versions prior to 2.9.2

Description The HT Mega – Absolute Addons For Elementor plugin for WordPress is susceptible to unauthorized modification and data loss. This is due to an insufficient capability check within the ajax trash templates function. Authenticated attackers possessing Contributor-level access or higher can delete arbitrary attachment files and move arbitrary posts, pages, and templates to the Trash.

Recommendations Update to version 2.9.2 or later. As a temporary workaround, restrict access for users with Contributor-level access or lower.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-8068

Affected Products

Absolute Addons For Elementor

Elementor

References · 9

• https://osv.dev/vulnerability/CVE-2025-8068 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8068 · Security Note
• https://plugins.trac.wordpress.org/changeset/3336533 · Patch
• https://t.me/CVEtracker/28852 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1950912072503439788 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d9cf6dae-572f-4eaa-8e8a-bca9e74fe738?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.9.0/admin/include/class.theme-builder.php#L625 · Note
• https://twitter.com/CVEnew/status/1950887269377671465 · Twitter Post
• https://t.me/cveNotify/130372 · Telegram Post