The vulnerability is a missing authorization check in Elementor Image Optimizer by Elementor, as described in the CVE, allowing attackers to exploit incorrectly configured access control. This broken access control can let an unauthenticated or low‑privileged user gain unauthorized access to functionality normally restricted by the plugin, potentially leading to data exposure or unauthorized configuration changes. The weakness aligns with CWE‑862.

The issue affects the WordPress plugin Elementor Image Optimizer by Elementor, with all releases up to and including version 1.7.1 susceptible. Sites running this plugin without the latest update are at risk. Since the plugin runs in a WordPress environment, any WordPress site that has installed the vulnerable version is potentially impacted.

The CVSS base score of 4.3 indicates moderate severity. An EPSS score of less than 1% suggests the probability of public exploitation is very low at the time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to reach the plugin’s protected endpoints, which are typically exposed to all visitors; thus the likely attack vector is remote via HTTP requests. Because the flaw stems from a missing authorization layer, an attacker who can trigger the vulnerable endpoint can bypass restrictions without needing valid credentials.