What is the CVSS score of EUVD-2026-15711?

EUVD-2026-15711 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Vertex Addons For Elementor are affected by EUVD-2026-15711?

CVE-2026-25398 presents notable security risk, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2026-15711?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Vertex Addons For Elementor EUVD-2026-15711

| CVE-2026-25398 MEDIUM

Missing Authorization (CWE-862)

2026-03-25 Patchstack

Authentication Bypass Vertex Addons For Elementor Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15711

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.

AnalysisAI

Vertex Addons for Elementor through version 1.6.4 contains an authorization bypass vulnerability that allows authenticated attackers to modify content or settings they should not have access to due to improperly configured access controls. An attacker with low-level user privileges can escalate their capabilities by exploiting the misconfigured security levels. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability is classified under CWE-862 (Missing Authorization), which represents a failure to properly enforce access control checks before granting access to protected resources or functionality. In the context of Webilia Inc. Vertex Addons for Elementor (affected CPE: cpe:2.3:a:webilia_inc.:vertex_addons_for_elementor:*:*:*:*:*:*:*:*), this is a WordPress plugin that extends the Elementor page builder with additional components. The vulnerability stems from incorrectly configured access control security levels within the plugin's codebase, likely in functions or AJAX endpoints that fail to validate user capabilities or nonces before processing requests. This allows attackers to interact with plugin functionality that should be restricted to authorized administrators or specific user roles.

RemediationAI

Update Webilia Inc. Vertex Addons for Elementor to the latest patched version greater than 1.6.4 immediately. Consult the Patchstack security advisory and the vendor's official update channel for the specific patched version number and installation instructions. Until patching is possible, implement the following interim controls: restrict WordPress admin access by IP allowlisting, disable the vulnerable plugin if it is not actively in use, review and strengthen user role assignments to limit who can access Elementor functionality, and monitor plugin activity logs for suspicious behavior. Additionally, enforce strong authentication measures such as two-factor authentication on all WordPress administrative accounts to reduce the risk of unauthorized access.