The vulnerability is a missing authorization check that allows an attacker to bypass the plugin’s access control and gain unauthorized access to sensitive administrative functions within the Elated Listing plugin. The flaw is a classic authorization bypass, potentially exposing configuration data and allowing further exploitation if the attacker extends privileges. The weakness is classified as CWE‑862, indicating that the application fails to enforce appropriate checks on authenticated requests.

The affected product is the Elated Listing plugin developed by Elated‑Themes. Versions up through 1.4 are impacted. Users running any release of the plugin prior to 1.5 have this flaw and should update.

With a CVSS score of 6.5, the severity is moderate. The EPSS score of less than 1% indicates low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through HTTP requests that exploit the plugin’s inadequate access checks. An attacker exploiting this flaw could gain administrative privileges within the WordPress instance and potentially manipulate listings or other protected resources.