CVE-2025-1639 is a missing authorization vulnerability (CWE-862) in the Animation Addons for Elementor Pro plugin for WordPress. The flaw exists because the install_elementor_plugin_handler() function does not perform capability checks before allowing plugin installation and activation. As a result, any authenticated user with at least Subscriber privileges can install arbitrary plugins, potentially leading to site compromise. This affects all versions up to and including 1.6 of the plugin. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability.

An attacker with low-level authenticated access (Subscriber or above) can install and activate arbitrary plugins on the affected WordPress site. This can lead to full site compromise, including data theft, defacement, or further malware infection. The impact is high on confidentiality, integrity, and availability of the site. The vulnerability is particularly dangerous if Elementor is not active, as it allows bypassing normal plugin installation restrictions.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict user roles to trusted individuals only and consider disabling or removing the vulnerable plugin if possible to prevent exploitation.