The vulnerability in WPvibes AnyWhere Elementor Pro allows an attacker to gain unauthorized access because the plugin fails to enforce proper authorisation checks. This missing authorisation can lead to an attacker performing actions or reading content that should be restricted. The weakness is classified as CWE‑862.

WordPress sites that use the WPvibes AnyWhere Elementor Pro plugin, versions up to 2.29, are affected. The plugin is implicated when access control settings are incorrectly configured.

The CVSS score is 4.3, indicating medium risk. The EPSS score of less than 1 % reflects low probability of exploitation, and the vulnerability is not included in CISA’s KEV catalog. Based on the description, the likely attack vector is through the web interface of a WordPress site that has the plugin installed, where a user could exploit the improperly configured access controls. The impact is confined to the scope of the WordPress user who has the plugin and its configuration.