The vulnerability is a missing authorization flaw in the Ultimate Store Kit Elementor Addons plugin version 2.9.4 and earlier, allowing an attacker to access or modify store configuration data due to incorrectly configured access control settings. This flaw is classified as CWE‑862. The primary impact is that an attacker could obtain or alter administrative settings, potentially compromising the integrity of the e‑commerce store and exposing sensitive configuration data.

The affected product is the bdthemes Ultimate Store Kit Elementor Addons plugin for WordPress, versions up to and including 2.9.4.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve remote exploitation through web‑based plugin endpoints; an attacker could exploit the flaw by interacting with the plugin’s exposed interfaces to gain unauthorized access or modify store settings.