The Spexo Addons for Elementor plugin for WordPress suffers from a missing capability check in the tmpcoder_theme_install_func() function across all versions up to 1.0.14. This missing authorization (CWE-862) allows authenticated users with low privileges (Subscriber-level and above) to install themes, which should normally require higher privileges. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. The impact is limited to integrity, with no confidentiality or availability impact noted. No patch or official remediation has been documented in the provided data.

Authenticated users with Subscriber-level access or higher can install themes without proper authorization, potentially leading to unauthorized modifications of the WordPress site’s appearance or functionality. There is no direct impact on confidentiality or availability reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious theme installation activities. Avoid granting unnecessary privileges to low-level users. Follow updates from the vendor or security advisories for a patch or official mitigation.