The vulnerability is an Authorization Bypass through a User‑Controlled Key that allows the installation of the Master Addons for Elementor plugin to expose insecure direct object references. Attackers can craft requests containing manipulated identifiers to retrieve or modify content that should be protected, leading to data disclosure or modification within the host site. The weakness arises from insufficient access control checks and is classified as CWE-639.

This issue affects WordPress sites that have the Liton Arefin Master Addons for Elementor plugin installed with a version number of 2.0.9.9.4 or earlier. No other products or versions are listed by the CNA as affected.

The CVSS score of 5.3 indicates a moderately high risk, yet the EPSS score of less than 1% suggests exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is through web requests to the plugin’s endpoints, where an attacker can supply a user‑controlled key to reference protected objects. Because the plugin does not properly validate access rights, the exploit requires only the ability to send crafted HTTP requests to the site with the plugin installed.