The vulnerability is an incorrect privilege assignment flaw in the LMS Elementor Pro WordPress plugin. It allows an attacker to elevate their access level within the WordPress installation, potentially giving them higher permissions than intended. This weakness is classified as CWE‑266. The impact is that an attacker with limited or even guest access could gain administrator capabilities, compromising the site’s confidentiality, integrity, and availability.

All installations of the designthemes LMS Elementor Pro plugin with version 1.0.4 or earlier are affected. No other versions or separate products are listed as impacted.

The CVSS score of 9.8 signals a critical severity. The EPSS score of less than 1 % indicates a low probability of exploitation at the moment, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector likely involves the plugin’s administrative interface, where an attacker with some level of authenticated or even unauthenticated access could manipulate user data to elevate privileges. Once escalated, the attacker can perform any action allowed to an admin, such as installing additional plugins, modifying site settings, or accessing sensitive user information.