The vulnerability CVE-2025-69312 affects Xpro Elementor Addons up to version 1.4.19.1 and involves unrestricted file upload functionality that does not properly restrict dangerous file types. This flaw allows an attacker with high privileges to upload a web shell, potentially leading to full system compromise. The CVSS 3.1 score is 9.1, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or vendor advisory is available to confirm remediation status.

Successful exploitation allows an attacker with high privileges to upload malicious files such as web shells, resulting in full compromise of the web server's confidentiality, integrity, and availability. This can lead to unauthorized code execution, data theft, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload functionality to trusted users only and consider implementing additional file upload validation controls or disabling the vulnerable plugin if feasible.