The vulnerability identified as CVE-2024-2619 in brainstormforce's Ultimate Addons for Elementor plugin arises from missing authorization checks and inadequate input sanitization in the Elementor Header & Footer Builder feature. Authenticated users with author-level permissions or higher can inject arbitrary HTML content into pages, which will be rendered when other users access those pages. This issue is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 5.0 (medium), reflecting network attack vector, low attack complexity, required privileges at the author level, no user interaction, scope change, no confidentiality impact, limited integrity impact, and no availability impact. The vulnerability affects all versions up to 1.6.26. No patch or official fix information is provided in the available data.

An authenticated attacker with author-level permissions or higher can inject arbitrary HTML into pages, potentially altering page content viewed by other users. This could lead to defacement or misleading content display but does not directly impact confidentiality or availability. The scope of the vulnerability is changed, meaning the impact extends beyond the attacker’s own privileges to affect other users viewing the injected pages. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level permissions to trusted users only and monitor for unusual page content changes. Avoid granting author-level access to untrusted users to reduce risk.