The vulnerability allows an unauthenticated attacker to gain administrator privileges within a WordPress site. This missing access control flaw (CWE‑266) could enable the attacker to alter content, install additional malware, or exfiltrate sensitive data. No credentials are required for exploitation.

The Easy Elements for Elementor – Addons & Website Templates plugin versions 1.4.9 and earlier, distributed by themewant, are affected. All WordPress sites that have installed a vulnerable version of this plugin are at risk; no other WordPress core or third‑party components are directly impacted.

The CVSS score of 9.8 indicates critical severity, while the EPSS score is not available but the lack of exploitation data suggests the opportunity may not yet be widely abused. The vulnerability is not listed in the CISA KEV catalog, yet its high score and unauthenticated nature make it a top priority. A likely attack vector would be a direct HTTP request to the vulnerable plugin endpoint from any external IP address, requiring no prior authentication.