The ElementsKit Elementor Addons plugin contains a missing capability check in the Live_Action::reset() function. When both a post parameter and the action=elementor query string are present, the function runs during WordPress initialization, overwriting the _elementor_data field of any elementskit_widget custom post type. The absence of authentication or nonce verification allows anyone with a crafted URL to replace a widget’s design, text, and configuration with a blank template, effectively altering site content and potentially affecting user experience and brand integrity.

The vulnerability impacts roxnor:ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor for all releases up to and including version 3.8.2.

The CVSS score of 6.5 indicates a moderate severity threat. With no EPSS score available and the issue not listed in the CISA KEV catalog, the likelihood of exploitation remains uncertain but non‑negligible. Attackers can trigger the flaw over the web by visiting a specifically crafted URL, requiring no credentials or knowledge of site internals. Once exploited, the integrity and availability of widget content are compromised, with the potential for widespread site defacement if many widgets are affected.