The vulnerability CVE-2025-10896 in the litonice13 Image Comparison Addon for Elementor arises from missing capability checks in the '*_recommended_upgrade_plugin' function. This flaw permits authenticated users with low privileges (subscriber-level and above) to upload arbitrary plugin packages through crafted plugin URLs. Such unrestricted upload of potentially dangerous files can enable remote code execution on the WordPress server hosting the plugin. The issue affects all versions up to 1.0.2.3 and is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with subscriber-level access or higher can exploit this vulnerability to upload arbitrary plugin packages to the affected WordPress site. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the site. The impact is high as it allows privilege escalation and full control over the affected server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions and monitor for suspicious plugin installations. Avoid granting unnecessary plugin installation capabilities to low-privilege users.