The vulnerability is a missing authorization flaw in the Unlimited Elements For Elementor plugin that permits an attacker to bypass the plugin’s access controls. An attacker who can trigger the plugin endpoints can modify or delete plugin configuration data, affecting the built‑in widgets, templates and custom addon settings. This type of broken access control (CWE‑862) can lead to unauthorized configuration changes that compromise the site’s presentation and functionality. Based on the description, it is inferred that the attacker would need authenticated access to the WordPress admin area or the plugin’s configuration pages to exploit this flaw.

Affected systems are installations of the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin from any release prior to 2.0.21. Versions 2.0.20 and earlier are vulnerable; the issue originates from incorrectly configured access control security levels hard‑coded in the plugin.

The vulnerability has a CVSS score of 5.3, indicating medium overall risk, with no EPSS score available and not listed in the CISA KEV catalog. Exploitation requires access to the WordPress admin area or the plugin’s configuration pages, so an attacker would need at least local or authenticated remote access. Because the flaw permits direct manipulation of plugin settings, the impact could range from site defacement to the disabling of key features, depending on the attacker’s intent.