The Royal Elementor Addons plugin has a missing authorization flaw that allows attackers to exploit incorrectly configured access control levels. This vulnerability can enable an attacker to access or manipulate content and settings that should be restricted, potentially compromising the integrity of the website and its data. The weakness is identified as CWE‑862, indicating that the application fails to check permissions before performing privileged actions.

Affected are installations of the WProyal Royal Elementor Addons WordPress plugin from its earliest release up through version 1.7.1068. The vulnerability exists on all versions in that range, regardless of operating system or WordPress core version. Users running any of these versions are susceptible until the plugin is updated.

The CVSS score of 4.3 indicates moderate risk, and the vulnerability is not listed in the CISA KEV catalog. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the available data. The attack vector is not explicitly defined in the advisory; it may be local or remote depending on the context in which the plugin is accessed. Exploitation requires the plugin to be installed with default or misconfigured access controls that permit privileged operations without proper verification.