The flaw is a missing authorization defect in the X Addons for Elementor plugin that allows an attacker to bypass configured access control security levels. By exploiting this weakness, a malicious actor could perform actions normally restricted, potentially reading or altering site content or configuration. The weakness is identified as CWE‑862 – Broken Access Control, which directly threatens content integrity and site configuration.

The affected product is the WordPress plugin X Addons for Elementor by pencilwp. All releases from the earliest available through version 1.0.23 are vulnerable. No specific sub‑versions beyond 1.0.23 are listed, indicating any installed instance of the plugin at or below this version is impacted.

The CVSS score of 4.3 classifies the impact as low, and the EPSS score of less than 1% signifies a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack path involves triggering the plugin’s functionality from a web request where authorisation checks are omitted. The exact exploitation conditions are not explicitly detailed, so it is inferred that an unauthenticated or authenticated request to the plugin’s exposed interfaces without proper role validation would be sufficient to bypass access controls.