The vulnerability in WProyal Royal Elementor Addons allows an attacker to bypass authorization by using a user‑controlled key to access resources they should not be able to view or manipulate. This IDOR flaw enables unauthorized reading or modifying of content through crafted requests, potentially exposing sensitive data or altering site content without permission.

Affected are WordPress sites using the Royal Elementor Addons plugin from any version up to and including 1.7.1069, installed by the vendor WProyal.

The CVSS score of 5.3 reflects moderate severity; EPSS is not available, so the exploitation probability cannot be quantified from the data. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is through an authenticated session with sufficient privileges, whereby an attacker manipulates request parameters to reference protected objects.