The vulnerability exists in the Post Carousel Slider for Elementor plugin where the process_wbelps_promo_form() function lacks a capability check. Authenticated users with Subscriber-level access or higher can invoke this function, allowing them to send arbitrary emails to the site’s support address. This does not provide code execution but enables spam, phishing, or targeted messaging from the server, which can undermine confidentiality and trust in the site’s communication channels.

WordPress sites running Plugindevs’ Post Carousel Slider for Elementor plugin up to and including version 1.6.0 are affected. No other plugins or product versions are listed as impacted.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated with a Subscriber or higher role, and they exploit the missing authorization check by invoking the support-form handler. The risk remains primarily the unauthorized use of the site’s email address for malicious messaging.