The Sky Addons for Elementor plugin suffers from a missing capability check in its save_options() function, which permits authenticated users with low privileges (subscriber-level and above) to update arbitrary options on the WordPress site. This flaw affects all versions up to and including 2.6.2 and can result in denial of service due to unauthorized data modification. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 8.1, indicating high severity. No official patch or vendor advisory is provided in the available data.

An attacker with subscriber-level access or higher can exploit this vulnerability to modify arbitrary option values stored as arrays within the WordPress site. This unauthorized modification can disrupt site functionality, potentially causing denial of service. There is no indication of confidentiality or availability impact beyond denial of service, and no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to option changes. Avoid granting subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor (wowdevs) for an official patch or temporary mitigation.