Unauthenticated Broken Access Control in the WordPress Essential Addons for Elementor plugin allows an attacker to perform privileged actions normally reserved for authenticated administrators. The vulnerability arises from insufficient checks on user permissions when accessing certain plugin functionalities, enabling a user with no credentials to manipulate settings or data that should be restricted.

Vendors: WPDeveloper. Product: Essential Addons for Elementor. Versions prior to 6.6.0 are affected. Any WordPress site running an older plugin version is at risk.

The CVSS score of 5.3 indicates a moderate severity. An EPSS score of < 1% suggests the current likelihood of exploitation is very low, and the vulnerability is not listed in CISA KEV. Nonetheless, exploitation is theoretically possible via crafted requests or URLs, and an attacker could gain unauthorized administrative capabilities if the site remains on a vulnerable plugin version.