The WPElemento Importer plugin for WordPress contains a missing authorization check that allows an attacker to invoke import functions normally reserved for administrators. This broken access control flaw, classified as CWE-862, enables unauthorized users to create or modify content and potentially expose sensitive data by sending crafted requests to the plugin’s import endpoint. The plugin processes external files, and a low‑privilege or unauthenticated user could exploit the flaw to alter site content without proper verification of permissions.

The vulnerability affects the WordPress plugin WPElemento Importer by the vendor wpelemento in all releases up to and including version 0.6.4. No other vendors or product variants are listed as impacted by the CNA.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the field. The flaw is not listed in the CISA KEV catalog, reducing its visibility. The likely attack vector is via web requests to the plugin’s import endpoint, and the broken access control permits execution even if the user is not authenticated or holds a limited role depending on site configuration.