Technical impact
The vulnerability exists in News Kit Addons For Elementor plugin versions prior to 1.4.9. A particular AJAX action, nekit_install_importer, lacks a capability check, allowing any authenticated user with subscriber-level access or higher to trigger plugin installation and activation of a specific plugin from the WordPress.org repository. This enables an attacker who can log in as a subscriber to install malicious code or modify site behavior, potentially compromising site confidentiality, integrity, and availability without requiring higher privileges.
Affected Systems
All WordPress sites that have the News Kit Addons For Elementor plugin installed with a version earlier than 1.4.9, regardless of the WordPress version or theme in use.
Risk and Exploitability
This is a classic privilege‑escalation vulnerability due to missing access control. The attacker only needs to be an authenticated user at subscriber level or better, which is a large attack surface. The CVSS score is 4.3, and the EPSS score is < 1%; the exploitation effort is low because it requires only a simple AJAX request. The vulnerability is not listed as a CISA KEV, but the impact could be significant if the site contains sensitive data or user accounts.
