Missing authorization in the Ovation Elements plugin allows an attacker to execute privileged actions or view sensitive data that should be protected. The vulnerability is classified as CWE-862 and can enable unauthorized modification of plugin settings, content, or configuration, potentially compromising the confidentiality and integrity of the WordPress site. The CVSS score of 4.3 indicates a moderate impact, but the risk remains significant because any exposed functionality may be leveraged to create a foothold in the broader application.

This flaw targets the Ovation Elements plugin developed by pewilliams for WordPress, affecting all releases through version 1.1.2 inclusive. WordPress sites that have any of these plugin versions installed and have not applied additional role‑based access controls are susceptible to exploitation.

The CVSS score of 4.3 reflects moderate severity, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely involve sending crafted HTTP requests to the plugin’s endpoints, enabling an attacker to bypass access checks that were incorrectly configured or removed, and thereby perform unauthorized actions within the WordPress administration context.