The Royal Elementor Kit WordPress theme suffers from a missing capability check on the dismissed_handler function, enabling authenticated users with subscriber-level access or higher to update arbitrary transient values. The update is limited to setting these transients to true, not arbitrary values. This vulnerability is classified as CWE-862 (Missing Authorization) and affects all versions up to and including 1.0.116. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An authenticated attacker with subscriber or higher privileges can update arbitrary transient values to true, which may lead to limited integrity impact within the affected WordPress site. There is no confidentiality or availability impact reported. The ability to modify transients could potentially be leveraged in combination with other vulnerabilities or misconfigurations but on its own does not allow arbitrary value injection or direct compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for updates from the vendor. No official patch or workaround has been provided at this time.