A missing authorization issue in the BdThemes Ultimate Store Kit Elementor Addons plugin allows attackers to access restricted functions or data. The vulnerability arises from incorrectly configured access controls, meaning that any authenticated or even unauthenticated user could potentially reach admin interfaces, change settings, or retrieve sensitive content. The impact includes potential compromise of confidentiality and integrity of the WordPress site, and could be a stepping stone for further exploitation.

The component affected is the WordPress Ultimate Store Kit Elementor Addons plugin from BdThemes, in all releases up to and including 4.0.1. Any WordPress installation that has this plugin installed and not yet updated beyond version 4.0.1 is vulnerable.

The CVSS score of 5.3 indicates a medium severity vulnerability. No EPSS score is available, and it is not listed in the CISA KEV catalog. The likely attack vector is via the web interface of the plugin, where an attacker could use crafted requests to bypass authorization controls. Because the flaw depends on incorrect access configuration, it may be exploitable without requiring privileged credentials.