The vulnerability is a missing authorization check in the WPVibes AnyWhere Elementor plugin, allowing users to perform privileged actions that should be restricted. This Broken Access Control flaw can result in unauthorized data disclosure or modification, directly compromising the confidentiality and integrity of WordPress sites. The weakness is a classic CWE-862 situation involving improper authorization controls.

Affected systems are WordPress installations running the WPVibes AnyWhere Elementor plugin from any version up to and including 1.3.0. Administrators should verify the plugin version on all websites.

The CVSS score of 6.5 indicates a moderate severity, and no EPSS score is available, suggesting limited publicly known exploits. The vulnerability is not listed in CISA's KEV catalog. Exploitation likely requires access to the WordPress admin area or the ability to interact with the plugin interface, implying that the attack vector is web-based and that users with administrative or editor permissions can leverage the flaw.