The vulnerability is a missing authorization flaw that allows an attacker to exploit incorrectly configured access control levels within the WordPress Post Carousel Slider for Elementor plugin. This flaw can enable unauthorized users to view or modify plugin settings and potentially alter content presented in the carousel slider, compromising data integrity and confidentiality.

WordPress administrators using the Post Carousel Slider for Elementor plugin version 1.7.0 or older are impacted. The issue was identified in all releases from the initial release through and including 1.7.0.

The CVSS score of 6.5 indicates a moderate severity risk. The EPSS score of less than 1% suggests that active exploitation is unlikely at present, and the vulnerability is not listed in CISA KEV. Because the attack vector requires authenticated access or a user with sufficient privileges to configure the plugin, the likelihood of exploitation depends on whether privileged accounts have been compromised or misconfigured.