Missing Authorization in Carter for Elementor creates a scenario where attackers can perform actions reserved for privileged users. The flaw comes from incorrectly configured access control checks, allowing unauthorized modification of site settings or insertion of content. Classified as CWE-862, it threatens the integrity and confidentiality of the website, potentially enabling malicious content injection or data tampering by users lacking proper rights.

WordPress installations that use the Carter for Elementor plugin developed by merkulove, specifically all releases from the initial launch up to and including version 1.0.2. These sites integrate the plugin with the Elementor page builder and expose the vulnerability through missing permission checks on administrative endpoints.

The CVSS score of 5.4 indicates medium severity, while the EPSS score of less than 1% suggests rare but possible exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread attacks exist yet. As a missing authorization flaw, an attacker who can reach the plugin’s administrative interface or craft targeted requests to its endpoints can bypass privilege checks. The attack vector is inferred to be remote via the web interface, as the exposed functions rely on role validation.