This vulnerability allows an unauthenticated attacker to bypass normal access restrictions within the Ultimate Store Kit Elementor Addons plugin, enabling them to perform privileged actions that should only be available to authorized users. The weakness is a classic broken access control flaw identified as CWE‑862, resulting in potential escalation of privileges, data tampering or modification, and unauthorized configuration changes.

The issue affects installations of the bdthemes Ultimate Store Kit Elementor Addons plugin for WordPress with versions up to and including 3.0.5. Systems running these versions are exposed until the plugin is upgraded to a patched release.

The CVSS base score of 6.5 places the vulnerability in the medium severity range. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated, an attacker can exploit it remotely via the web interface by crafting requests that leverage exposed endpoints or administrative hooks within the plugin. Successful exploitation would give the attacker the same permissions as the compromised account or, in worst cases, full privilege if the access control is global for the site.