A missing authorization check in DethemeKit For Elementor allows an attacker to perform privileged operations within the plugin. The flaw permits users to access and modify plugin settings without proper verification of role or permissions, leading to accidental or malicious changes to site configuration that could impact content, appearance, or functionality. The vulnerability is classified as broken access control (CWE-862) and does not directly enable code execution but can expose the site to further compromise by altering core plugin behavior.

The vulnerability affects all installations of the DethemeDethemeKit For Elementor plugin, developed by Detheme, version 2.1.10 and earlier. Users utilizing any older releases are at risk until the plugin is upgraded to a fixed version.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests the probability of exploitation is low. The vulnerability is not listed in CISA KEV. An attacker would need to send crafted requests to the plugin’s administrative endpoints to exploit the missing authorization; this is likely achievable from any web-accessible location, making the attack vector remote. While the risk is not critical, the impact on site configuration warrants timely remediation.