The Animation Addons for Elementor Pro plugin fails to perform a capability check in its install_elementor_plugin_handler() function, allowing an attacker who has at least Subscriber privileges to install and activate any WordPress plugin. This flaw permits the immediate deployment of malicious code without further interaction, and since the vulnerability exists in all releases up to and including 1.6, it applies broadly to sites running those versions. The associated weakness is identified as CWE-862, indicating missing authentication or authorization checks.

The affected product is the Animation Addons for Elementor Pro plugin published by crowdyTheme. Versions 1.6 and all earlier releases are impacted; no later versions are listed as vulnerable in the provided data.

The CVSS score of 8.8 reflects a high severity for this flaw, and the EPSS score of 11% suggests a measurable likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be authenticated, with the attacker needing only to be logged in as a Subscriber or higher. Once authenticated, the attacker can invoke the vulnerable handler to upload any plugin package, leading to arbitrary code execution once the plugin is activated. No additional exploitation prerequisites are noted.