A missing authorization flaw in the WordPress Better Post & Filter Widgets for Elementor plugin allows an attacker to bypass intended access controls and manipulate widget configuration or other protected data. The vulnerability is mapped to CWE-862, indicating that privilege verification is insufficient. An attacker who can exploit this flaw may view, modify, or delete widget settings, potentially compromising site presentation or exposing sensitive information, which represents a moderate risk of confidentiality and integrity compromise.

The affected product is the WP Smart Widgets: Better Post & Filter Widgets for Elementor plugin. Versions from any unversioned release up to and including 1.9.1 are impacted. The plugin is a WordPress component that integrates with the Elementor page builder and is typically installed on sites that require dynamic post filtering widgets.

The CVSS score of 6.5 suggests a moderate but not extreme severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that large‑scale exploitation has not yet been confirmed. Based on the description, the attack likely requires authenticated access to the WordPress administration interface, as the vulnerability exploits incorrectly configured access control levels within the plugin. If an attacker has administrative or sufficient user privileges, they can potentially leverage the flaw to alter widget behavior or expose hidden content.