The vulnerability is a Missing Authorization flaw in the Product Carousel Slider for Elementor plugin, allowing an attacker to exploit incorrectly configured access control security levels. This flaw enables users with improperly granted privileges to access restricted functions within the plugin, potentially bypassing intended restrictions. The impact is limited to unauthorized use of plugin features, without immediate escalation to higher-level system compromises.

The issue affects all installed instances of Product Carousel Slider for Elementor up to version 2.1.3, including earlier releases lacking a definitive minimum version. Users should verify the precise version of the plugin installed and ensure it is not one of the affected releases.

The CVSS score of 3.5 indicates a low severity vulnerability, and the EPSS score of less than 1% implies a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting no documented active exploitation at present. Likely attack vectors involve a legitimate user exploiting misconfigured permissions or a user who has obtained elevated local access to manipulate plugin settings.