The vulnerability is a missing authorization flaw in the WPVibes AnyWhere Elementor WordPress plugin. It allows an attacker to bypass intended access restrictions and exploit incorrectly configured access control security levels within the plugin. This can lead to unauthorized use of the plugin’s functionality, potentially enabling modification or exposure of site content or settings that are meant to be restricted to privileged users.

The issue affects all installs of the WPVibes AnyWhere Elementor plugin from the earliest bundled versions through 1.3.0. Any WordPress site that has installed or activated the plugin prior to updating to 1.3.1 is potentially vulnerable.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. An EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known widely exploited issue as of now. The attack vector is inferred to be remote, acting through the plugin’s administrative interface or configuration pages, and may require either an authenticated user with elevated privileges or the ability to directly access the plugin’s settings. No publicly disclosed exploitation technics or proof‑of‑concept artifacts are referenced in the available data, so the exact feasibility to achieve full compromise remains unclear.