This vulnerability allows an attacker to bypass authentication by using an alternate path or channel within the Miraculous Elementor WordPress plugin. By exploiting the authentication abuse flaw, an attacker can gain unauthorized access to the site’s administrative functions, potentially stealing data, modifying content, or escalating privileges. The weakness is classified as CWE‑288, indicating improper authentication management.

The affected product is the Miraculous Elementor plugin developed by kamleshyadav. All releases from the earliest available version up to and including 2.0.7 are vulnerable.

The CVSS score of 8.8 indicates a high severity level. EPSS is reported as less than 1%, suggesting that exploit activity is expected to be low at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote web-based attack where an adversary sends crafted requests to the plugin’s authentication endpoints to gain access. Exploitation requires network access to the WordPress instance and the vulnerable plugin to be active.