The Borderless – Addons and Templates for Elementor WordPress plugin suffers from a code injection vulnerability (CWE-94) in its 'write_config' function. This occurs because the plugin fails to properly sanitize input from an imported JSON file, enabling authenticated users with Administrator privileges to execute arbitrary code remotely on the server. The vulnerability affects all versions up to 1.6.0. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Administrator-level access can exploit this vulnerability to execute arbitrary code on the affected server. This could lead to full compromise of the WordPress site and potentially the underlying server environment, impacting confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to JSON import functionality. Avoid importing untrusted JSON files. Follow vendor communications for updates on patches or official mitigations.