This vulnerability is a missing authorization flaw in the DevItems HT Mega plugin for WordPress, allowing attackers to exploit incorrectly configured access control security levels. The weakness is categorized as CWE‑862, indicating a failure to restrict access to privileged functions. As a result, an attacker who can reach the plugin’s functions can perform actions normally reserved for higher‑privileged users, potentially altering content or configuration settings without authorization.

The affected product is DevItems HT Mega for Elementor. All releases from the inception of the plugin up through version 2.9.0 are vulnerable. WordPress sites that have this plugin installed and configured are therefore at risk.

The CVSS score of 5.4 places this vulnerability in the medium‑to‑high severity range. The EPSS score of less than 1 % suggests a low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. Attackers would most likely reach the vulnerable functionality by accessing the plugin’s web interfaces on the site; an incorrect or missing authorization check would allow them to invoke privileged operations. The likely attack vector is inferred from the missing authorization check. While there is no specific mention of remote code execution or data exfiltration, the ability to perform unauthorized actions could lead to configuration changes, content tampering, or other integrity violations.