The vulnerability arises from missing authorization checks, allowing attackers to exploit incorrectly configured access control security levels and gain unauthorized access to plugin features. This Broken Access Control flaw (CWE‑862) lets a malicious actor view, modify, or delete Elementor content, thereby compromising the confidentiality, integrity, and availability of the site.

WordPress users running any version of the Responsive Addons for Elementor plugin up to version 2.0.8, released by CyberChimps, are affected. The issue exists from the earliest available release through 2.0.8, so all installations of those versions are vulnerable unless updated.

With a CVSS score of 6.5, the flaw presents a moderate severity risk. The EPSS score of less than 1% indicates a low likelihood of being actively exploited. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation currently. The attack likely requires the attacker to have some access to the WordPress administrative interface or to craft requests that bypass normal permission checks, but the absence of a high exploitation probability moderates urgency.