This vulnerability is a missing authorization issue that allows attackers to exploit incorrectly configured access control settings, leading to unauthorized changes in the Buttoner for Elementor plugin configuration. The weak protection permits users to modify plugin options without proper privilege checks, potentially altering site behavior or creating security weaknesses. The associated weakness is identified as CWE-862, which represents an inadequate authorization mechanism.

Affected product: Buttoner for Elementor by merkulove. Any installation of this plugin versions n/a through 1.0.6 is vulnerable. Users running WordPress sites with the plugin listed here are exposed.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation observed so far. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is a missing authorization, the most likely attack vector is through the plugin’s administrative interface using a user account that has any level of access—whether normal or low‑privilege. An attacker can manually adjust settings or potentially redirect plugin behavior, depending on the functions exposed by the plugin.