The vulnerability is a broken access control in Elementor Website Builder that allows an attacker to manipulate content or settings due to incorrect configuration of access control levels. This lack of proper authorization checks can enable unauthorized users to perform privileged actions, compromising the integrity of site content and configurations. The weakness is identified as CWE‑862 (Missing Access Control).

Elementor:Elementor Website Builder plugin versions up to and including 3.35.5 are affected. The vulnerability applies to all releases from the earliest available through 3.35.5, as indicated by the vendor’s version range.

The CVSS score is 2.7, indicating low severity, and the EPSS score is less than 1%, implying a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires access to the site's administrative interface or other privileged roles that are improperly restricted. No specific exploit details are provided, but an attacker could potentially exploit misconfigured role permissions to gain unauthorized access to sensitive site functions.