The Sky Addons for Elementor plugin suffers from a missing authorization check (CWE-862) in its save_options() function, resulting in a CSRF vulnerability. Because nonce validation is absent or incorrect, attackers can craft forged requests that, when executed by an authenticated administrator, update arbitrary plugin options. This can lead to integrity and availability impacts on the WordPress site. The vulnerability affects all versions up to and including 2.6.1. No official patch or vendor advisory has been provided yet.

An attacker can cause an authenticated administrator to unknowingly modify plugin options by tricking them into clicking a malicious link, potentially leading to unauthorized changes to site configuration. This impacts the integrity and availability of the affected WordPress site. There is no direct confidentiality impact reported. The CVSS score of 8.1 reflects the high potential impact and ease of exploitation due to no privileges required and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress and consider restricting administrative access or using additional security plugins that provide CSRF protections. Monitor official wowdevs communications for updates on patches or mitigations.