The weakness is a missing authorization check in honzat Page Manager for Elementor. In all releases up to and including 2.0.5, users lacking proper privileges can invoke privileged functions, allowing an attacker to create, modify, or delete pages that should be protected. This lifts privileges and compromises the confidentiality and integrity of site content.

WordPress sites that use the honzat Page Manager for Elementor plugin are impacted. All plugin releases from the initial version through 2.0.5 are affected; sites running any of these versions should be considered vulnerable.

The CVSS score of 7.6 signals a moderate‑to‑high severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation presently. Because the flaw stems from improperly configured access levels, an attacker can exploit it by sending crafted web requests to the plugin’s administrative endpoints without the correct permissions; the attack is likely remote via the web. The vulnerability is not listed in the CISA KEV catalog.