The vulnerability is a missing authorization flaw that permits unauthorized access to functions normally protected by role or user level checks within the Unlimited Elements For Elementor plugin. This broken access control can enable an attacker to perform actions or view content that should be restricted, potentially exposing sensitive site information or allowing manipulation of site elements. The nature of the flaw is described as a basic broken access control weakness (CWE-862).

All installations of the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin from the initial release up to version 2.0.15 are affected.

The CVSS score of 5.4 indicates a medium severity vulnerability. Because no EPSS score is provided it is unclear how frequently this flaw is being exploited in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The potential attack vector is inferred to be a web‑based interaction, likely involving crafted HTTP requests or interface manipulation, as the flaw arises from incorrect access control enforcement within the plugin’s functions. Administrators should treat this risk as moderate and assume that successful exploitation would grant unintended privileges on the affected site.