CVE-2025-8488: Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savehfecompatibilityoptioncallback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8488?
CVE-2025-8488 has been classified as a medium severity vulnerability due to its potential for unauthorized modification of data.
How do I fix CVE-2025-8488?
To mitigate CVE-2025-8488, update the Ultimate Addons for Elementor plugin to the latest version beyond 2.4.6.
Who is affected by CVE-2025-8488?
Any WordPress site using Ultimate Addons for Elementor plugin versions up to and including 2.4.6 is vulnerable to CVE-2025-8488.
What type of vulnerability is CVE-2025-8488?
CVE-2025-8488 is classified as a security vulnerability due to missing capability checks in the plugin's functionality.
What are the potential consequences of CVE-2025-8488?
CVE-2025-8488 may allow an attacker to make unauthorized changes to the website's data, leading to potential defacement or data loss.