Introduction
Attackers with even the lowest level of authenticated access can take over WordPress sites running certain Jewel Theme plugins by uploading a malicious plugin package. The impact is immediate. Exploiting the vulnerability can lead to remote code execution and full compromise of the affected site.
Jewel Theme sells WordPress plugins and themes, including WP Adminify, Master Addons for Elementor, and Master Blocks. Its products are widely used for site customization and page building, and they are sold both directly and through marketplaces like Envato. Several of these products bundle the Jewel Theme Recommended Plugins Library, so a vulnerability in this shared component reaches every product that ships it.
Technical Information
CVE-2025-10896 is a critical vulnerability (CVSS 8.8) in the Jewel Theme Recommended Plugins Library that affects all versions up to and including 1.0.2.3. It comes from missing capability checks in the *_recommended_upgrade_plugin function. That function handles plugin installation requests but does not check whether the current user has the privileges to install plugins. Any authenticated user with subscriber-level access or higher can therefore trigger an installation.
The function also accepts arbitrary plugin URLs, so an attacker can point it at a malicious plugin package they control. The vulnerable code then downloads and installs that plugin with no server-side check of the user's capability or of the plugin source. Because an installed plugin can run arbitrary PHP code in the context of the WordPress site, this amounts to remote code execution.
The vulnerable logic appears in several files in the affected plugins, including:
Libs/Assets.phpat line 70Libs/Recommended.phpat lines 43 and 334
These files are public in the plugin's source repository, and vulnerability advisories have referenced them (Wordfence).
The root cause is that the code allows plugin installation without a server-side capability check such as current_user_can('install_plugins'). Combined with the acceptance of arbitrary plugin URLs, that gives low-privilege users a direct path to privilege escalation and code execution.
Affected Systems and Versions
- Jewel Theme Recommended Plugins Library: all versions up to and including 1.0.2.3
- Any WordPress plugin bundling this library, including but not limited to:
- Image Hover Effects Addon for Elementor (as referenced in the WordPress plugin repository)
- Other Jewel Theme products that include the vulnerable library
The vulnerability is present regardless of other site configuration, as long as the site uses an affected library version and either has user registration enabled or has existing subscriber accounts.
Vendor Security History
Jewel Theme products have a documented history of authorization and input validation vulnerabilities. Notable examples include:
- CVE-2024-29911: Stored cross-site scripting in Master Addons for Elementor
- CVE-2024-33595: Missing authorization in Master Addons for Elementor
These earlier issues show recurring problems with access control and input handling, which suggests the vendor's secure development practices need improvement.
