DethemeKit For Elementor suffers a missing authorization flaw that permits exploitation when access control is incorrectly configured. The vulnerability means an attacker can use plugin‑provided functions without being properly authenticated, enabling unauthorized actions. The impact is primarily elevated privileges leading to unauthorized configuration changes, data exposure, or further attacks against the WordPress site.

DethemeKit For Elementor version 2.1.10 and earlier are affected. The plugin is offered by Detheme for WordPress sites using the Elementor page builder.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the web interface where the plugin’s administrative pages are reachable, possibly requiring the attacker to craft requests that bypass normal permission checks. No remote code execution is described, so the threat is limited to unauthorized access and privilege escalation within the WordPress environment.