The flaw stems from a missing capability check on a plugin upgrade function, allowing any user with subscriber-level access or higher to supply an arbitrary plugin URL and trigger an installation. Once a plugin package is placed on the server, the WordPress core will unpack and activate it, giving the attacker the ability to run code with the same privileges as the user who performed the upload. The vulnerability is rooted in an authorization weakness (CWE-862) and can lead to full system compromise if the uploaded plugin contains malicious payloads.

WordPress sites that have installed any of the following plugins from the Jewel Theme Recommended Plugins Library: Content Locker for Elementor, Image Comparison Addon for Elementor, Image Hover Effects for Elementor, and Master Blocks – Ultimate Gutenberg Blocks for Marketers. The issue exists in all released versions up to and including 1.0.2.3, regardless of the site’s theme or other plugins.

The CVSS score of 8.8 indicates a high severity, reflecting the potential for significant damage from an authenticated attacker. The EPSS score of less than 1% suggests that, at present, automated exploitation is unlikely, yet the presence of the vulnerability in widely used community plugins keeps it a realistic risk for sites run by organizations with some level of internal access. As the vulnerability is not listed in the CISA KEV catalog, there is no widespread exploit campaign known, but the controlled nature of the attack vector—requiring subscriber+ login—still makes the issue a critical concern for hosts that allow such users to manage site content.