A flaw in ElementInvader Addons for Elementor enables users with insufficient privileges to manipulate plugin functions that should be restricted, effectively bypassing the intended access controls. The vulnerability stems from missing authorization checks and is classified as CWE‑862. Consequently, an attacker who can authenticate to the WordPress site may gain the ability to modify or delete content delivered by the plugin, potentially undermining confidentiality and integrity of site data.

WordPress sites running ElementInvader Addons for Elementor plugins through version 1.3.1 are impacted. The affected product, managed by Element Invader, includes all releases up to and including 1.3.1 on the WordPress platform.

The CVSS score of 4.3 indicates a low‑to‑medium severity, and the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation would likely occur via the web interface of a logged‑in WordPress account and does not provide remote code execution. Nonetheless, the lack of proper controls could allow an attacker to elevate privileges within the plugin’s scope.