CVE-2025-32201

Vulnerability

Missing Authorization vulnerability in the Xpro Theme Builder for Elementor plugin (xpro-theme-builder) versions from n/a through 1.2.8.4 [1]. This issue allows exploiting incorrectly configured access control security levels, meaning the plugin fails to properly enforce permission checks on certain actions or endpoints.

Exploitation

An attacker with low privileges or no authentication, depending on the misconfiguration, can access or perform actions restricted to higher-level users. The exact attack vector is not detailed in the available references, but the vulnerability stems from missing authorization checks in the plugin's code.

Impact

Successful exploitation could allow an attacker to bypass intended access restrictions, potentially leading to privilege escalation, unauthorized data access, or modification of site content. The scope and severity depend on which unprotected functionality is exposed.

Mitigation

The vulnerability affects versions up to and including 1.2.8.4. The vendor released version 1.2.11 as of 2025-09-04 [1], and users should update to this fixed version or later. No workarounds are documented in the provided references.