The flaw arises from incorrect privilege assignment within the WordPress Essential Addons for Elementor plugin, enabling a user with limited permissions to gain higher security roles and perform actions reserved for administrators. The ability to elevate privileges could compromise content integrity, allow unauthorized configuration changes, and potentially lead to further exploitation if additional vulnerabilities exist.

All releases of the WPDeveloper Essential Addons for Elementor plugin up to and including version 6.8.5 are affected. The plugin is a WordPress add‑on used for adding Elementor elements, and the issue applies to the core plugin version regardless of the site’s theme or other plugins. Updating to version 6.8.6 or later resolves the vulnerability.

The CVSS score of 6.4 classifies the vulnerability as moderate risk. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploit yet. Based on the description, the likely attack vector requires an authenticated user who can access the plugin’s configuration or administration interfaces; the attacker may then trigger the privilege escalation logic. While exploitation conditions and public exploit evidence are not stated in the data, the moderate CVSS score and absence of proven exploitation still warrant a proactive response.