Technical impact
Missing authorization check in the Imager for Elementor plugin, affecting all versions up to and including 2.0.4, permits an attacker to bypass the WordPress access controls that normally restrict which users can invoke plugin functions or view plugin‑protected content. This flaw, identified as CWE‑862, means that lower‑privileged users could potentially perform actions or access data that should be restricted, thereby compromising the confidentiality or integrity of site content.
Affected Systems
All WordPress sites that have been installed with the Merkulove Imager for Elementor plugin in any version from the earliest release through version 2.0.4 are impacted. The vulnerability is present in every release with a version number less than or equal to 2.0.4, regardless of the underlying WordPress core version.
Risk and Exploitability
The CVSS score of 5.4 labels this issue as moderate risk, and the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. While the CVE description does not detail the exact attack vector, it is inferred that an attacker would need to send a crafted request to a protected plugin endpoint or API that is not properly gated by authorization checks; this inference is based on the typical behavior of broken access control flaws.
