The vulnerability is a broken access control flaw in the WordPress JetBlocks For Elementor plugin. A missing authorization check allows users to execute privileged actions—such as creating, editing, or deleting blocks and page elements—that should be restricted to higher‑level roles. If exploited, an attacker could manipulate site content or potentially pivot to additional weaknesses inherent in the page‑building workflow.

This issue affects Crocoblock JetBlocks For Elementor plugin versions from the earliest community release through 1.3.16. Any WordPress site that has not yet upgraded beyond 1.3.16 is vulnerable.

The vulnerability carries a CVSS score of 7.5, indicating high severity, while the EPSS score of <1% suggests a low but non‑zero likelihood of exploitation at present. It is not cataloged in the CISA KEV database. Based on the description, it is inferred that the attack vector is remote via HTTP, and that an authenticated session—although not necessarily an admin session—is sufficient to leverage the flaw. If an attacker can log into the site with any user role, they may be able to perform unauthorized content‑management actions. The absence of a sophisticated exploitation chain makes patching the most effective mitigation.