The ElementsReady Addons for Elementor WordPress plugin fails to verify user authorization before executing several of its settings-save handlers. This flaw permits any user with the subscriber role or higher to overwrite the plugin’s stored configuration, including API credentials and feature templates. The weakness aligns with improper access control (CWE-284) and allows an attacker to alter or leak sensitive configuration data, potentially enabling credential theft or malicious feature activation.

The vulnerable product is the ElementsReady Addons for Elementor WordPress plugin, including all versions up to and including 6.7.2. Users of this plugin should verify that they are running a newer release that incorporates the missing authorization checks.

Because the vulnerability is only exposed to authenticated users with subscriber-level access or higher, any legitimate account in such a role can exploit it. The CVSS score of 4.3 indicates moderate severity. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the absence of any access checks and the ability to modify credential configurations suggest a moderate to high potential impact if an attacker gains a subscriber-level account. The attack vector is likely the standard plugin settings page in the WordPress admin interface, requiring no special tools or network exposure beyond normal authenticated access.