The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress suffers from an improper access control vulnerability (CWE-284) due to the absence of a capability check in the templates_ajax_request function. This flaw permits users with subscriber or higher privileges to create templates, which should normally require elevated permissions. The vulnerability affects all versions up to 1.4.4. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and resulting in integrity impact only. No known exploits in the wild or patches have been reported.

An attacker with subscriber-level access or higher can exploit this vulnerability to create templates within the plugin, leading to unauthorized modification of data. There is no confidentiality or availability impact reported. The integrity of the plugin's template data can be compromised, potentially affecting site content or appearance controlled by these templates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized template creation. Avoid granting subscriber or higher privileges to untrusted users. Follow updates from envothemes for any forthcoming patches or official mitigations.