The vulnerability arises from a missing capability check in the render_preview function of the Master Addons for Elementor Premium plugin. An attacker who authenticates to the WordPress site with at least Subscriber-level access can trigger this function and inject arbitrary code, leading to full compromise of the web server. This flaw is classified as CWE-94, which denotes code injection weaknesses.

The problem affects Jewel Theme’s Master Addons for Elementor Premium plugin in all released versions up to and including 2.1.3. The plugin operates within the WordPress CMS, and any site that has installed or upgraded to this version range is potentially vulnerable unless the preview feature is disabled for non-administrators.

With a CVSS score of 8.8, the flaw is considered high severity. However, the EPSS score is less than 1%, indicating that immediate exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits have been confirmed. The attack requires authentication, so it is limited to roles that can access the WordPress Admin dashboard; once authenticated, the attacker can execute arbitrary code via the preview renderer.