CVE-2025-10896 Overview
Multiple WordPress plugins bundled with the Jewel Theme Recommended Plugins Library contain a missing authorization flaw [CWE-862] that enables arbitrary plugin installation. The vulnerability affects all versions up to and including 1.0.2.3. Authenticated attackers with subscriber-level access can supply a crafted plugin URL to the *_recommended_upgrade_plugin function. The function lacks capability checks, allowing arbitrary plugin packages to be uploaded to the server. This file upload primitive can lead to remote code execution on the affected WordPress site.
Critical Impact
A subscriber-level account can install arbitrary plugins from attacker-controlled URLs, achieving remote code execution and full site compromise.
Affected Products
- Jewel Theme image-hover-effects-elementor-addon (versions ≤ 1.0.2.3)
- Jewel Theme image-comparison-elementor-addon
- Jewel Theme content-locker-for-elementor and ultimate-blocks-for-gutenberg
Discovery Timeline
- 2025-11-04 - CVE-2025-10896 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-10896
Vulnerability Analysis
The vulnerability resides in the Jewel Theme Recommended Plugins Library shared across multiple WordPress plugins. The library exposes an AJAX-callable function named *_recommended_upgrade_plugin that is intended to install vendor-recommended plugins from the WordPress.org repository. The handler does not enforce a current_user_can('install_plugins') capability check before invoking the WordPress plugin installer. Any authenticated user, including subscriber-level accounts, can trigger the function. The handler also accepts an attacker-supplied plugin URL rather than constraining input to vetted, repository-resident slugs. This combination converts a privileged administrative action into an unauthenticated-class operation available to the lowest privileged role.
Root Cause
The root cause is missing authorization [CWE-862] on a state-changing AJAX endpoint. The Recommended.php handler registered via wp_ajax_* does not validate user capabilities and does not restrict the source URL parameter. Because WordPress sites commonly allow open user registration at the subscriber role, the missing check effectively lowers the trust boundary for plugin installation to anyone who can register.
Attack Vector
An attacker registers a subscriber account on the target site or compromises an existing low-privilege account. The attacker then issues an authenticated AJAX request to the vulnerable admin-ajax.php action, supplying a URL pointing to a malicious ZIP archive. The plugin installer downloads, extracts, and activates the archive inside the wp-content/plugins/ directory. Code contained in the archive executes within the WordPress process, granting the attacker remote code execution as the web server user. Vendor source references are available in the WordPress Plugin Recommended Code and the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-10896
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php with an action parameter ending in _recommended_upgrade_plugin.
- New plugin directories under wp-content/plugins/ that were not installed by an administrator.
- New PHP files with recent modification timestamps inside wp-content/plugins/ or wp-content/uploads/.
- Outbound HTTP requests from the WordPress server to attacker-controlled URLs hosting ZIP archives.
Detection Strategies
- Inspect web server access logs for authenticated subscriber accounts triggering plugin install actions.
- Monitor the WordPress options table and active_plugins entry for additions that lack a corresponding admin audit trail.
- Alert on file creation events targeting wp-content/plugins/ outside of scheduled maintenance windows.
Monitoring Recommendations
- Enable file integrity monitoring across wp-content/plugins/ and wp-content/mu-plugins/.
- Forward WordPress and web server logs to a centralized analytics platform and alert on admin-ajax.php actions matching *recommended*plugin*.
- Track creation of new low-privilege user accounts followed within minutes by AJAX activity to plugin install endpoints.
How to Mitigate CVE-2025-10896
Immediate Actions Required
- Update every affected Jewel Theme plugin to a version newer than 1.0.2.3 immediately.
- Disable open user registration or restrict the default role to a non-functional value until patches are applied.
- Audit wp-content/plugins/ for unfamiliar directories and remove any unauthorized plugins.
- Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.
Patch Information
The vendor released fixes through WordPress.org plugin updates. See the relevant changesets for image-hover-effects-elementor-addon, image-comparison-elementor-addon, content-locker-for-elementor, and ultimate-blocks-for-gutenberg. Apply updates via the WordPress dashboard or wp-cli.
Workarounds
- Deactivate and remove the affected Jewel Theme plugins until updates can be installed.
- Block requests to admin-ajax.php where the action parameter matches *_recommended_upgrade_plugin using a web application firewall rule.
- Restrict subscriber registration on production sites by setting users_can_register to 0.
# Disable open registration and update vulnerable plugins via wp-cli
wp option update users_can_register 0
wp plugin update image-hover-effects-elementor-addon
wp plugin update image-comparison-elementor-addon
wp plugin update content-locker-for-elementor
wp plugin update ultimate-blocks-for-gutenberg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
