The Plus Addons for Elementor plugin contains an AJAX handler that authorizes users only with the general 'edit_posts' capability while passing a user-controlled 'post_type' directly to WordPress's wp_insert_post. This bypasses post‑type specific permission checks, allowing any authenticated author or higher to create draft posts for normally restricted types such as 'page' and 'nxt_builder', effectively granting unauthorized content creation.

WordPress sites running the Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin up to and including version 6.4.7. The issue affects the plugin itself; no other components are explicitly listed.

The CVSS score of 4.3 indicates low‑to‑moderate severity. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation activity so far. Based on the description, the likely attack vector is remote via the plugin’s AJAX endpoint, requiring the attacker to be authenticated with Author‑level privileges or higher. Once authenticated, an attacker can submit the 'post_type' parameter to create arbitrary draft content.