The vulnerability is a missing authorization flaw in the Huger for Elementor plugin by merkulove, allowing an attacker to bypass configured access controls and gain unauthorized actions within a WordPress site. Because the plugin does not perform proper checks, attackers could potentially create, edit, or delete content or settings intended for restricted users, resulting in moderate confidentiality and integrity damage.

Affected systems are sites running the Huger for Elementor plugin from merkulove, specifically all versions from the earliest release through 1.1.5. WordPress sites that rely on this plugin within that version range are impacted, with no other vendors or product variants listed.

The CVSS score of 5.4 places the vulnerability in the medium range, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. While the issue is not listed in the CISA KEV catalog, it remains a concern for any site that uses the affected plugin. The likely attack vector is remote, through the WordPress admin area or REST API where the plugin’s functionality is exposed, allowing an attacker to elevate privileges over the plugin’s features and compromise broader site security.