The Xpro Elementor Addons - Pro plugin for WordPress contains a remote code execution vulnerability (CWE-94) due to improper control of code generation. Specifically, the plugin relies solely on client-side controls to restrict access to a custom PHP widget, which can be bypassed by authenticated users with Contributor-level permissions or above. This flaw enables these users to execute arbitrary code on the server, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. No patch or official fix has been documented as of the published date.

Successful exploitation allows authenticated users with Contributor-level or higher privileges to execute arbitrary code on the server hosting the WordPress site. This can lead to full system compromise, including unauthorized data access, modification, and service disruption. The vulnerability impacts all plugin versions up to 1.4.9. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for updates from WPXpro regarding a security patch or official mitigation steps. Avoid using the vulnerable custom PHP widget if possible.