PT-2026-31563 · WordPress+1 · Vertex Addons For Elementor+1

Athiwat Tiprasaharn · Published 2026-04-09 · Updated 2026-04-18 · CVE-2026-4326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vertex Addons for Elementor plugin for WordPress versions up to and including 1.6.4

Description The Vertex Addons for Elementor plugin for WordPress is susceptible to a missing authorization issue. This is caused by insufficient authorization checks within the activate required plugins() function. The current user can('install plugins') capability check does not halt execution upon failure, instead only setting an error message while allowing plugin installation and activation to proceed. This allows authenticated attackers with Subscriber-level access or higher to install and activate arbitrary plugins.

Recommendations Update Vertex Addons for Elementor plugin to a version greater than 1.6.4.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4326

Affected Products

Elementor

Vertex Addons For Elementor

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2026-4326 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3491143%40addons-for-elementor-builder&new=3491143%40addons-for-elementor-builder&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/tags/1.6.4/app/Ajax.php#L278 · Note
• https://twitter.com/CVEarity/status/2042289236964229442 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042100937427124337 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/tags/1.6.4/app/Ajax.php#L264 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/trunk/app/Ajax.php#L229 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/trunk/app/Ajax.php#L278 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/trunk/app/Ajax.php#L264 · Note
• https://twitter.com/CVEnew/status/2042186496527196591 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1bb409f0-ccbd-4dfa-b097-b29ee539daa3?source=cve · Note
• https://twitter.com/giuseppe_1337/status/2045332893648502869 · Twitter Post
• https://twitter.com/CveFindCom/status/2042101513368064252 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addons-for-elementor-builder/tags/1.6.4/app/Ajax.php#L229 · Note
• https://twitter.com/infoflowcloud/status/2042187675638120901 · Twitter Post