CVE-2024-3249 is a missing authorization vulnerability (CWE-862) in the Zita Site Library for Elementor WordPress plugin. The flaw exists because key functions—import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings—do not perform proper capability checks. This allows authenticated users with low privileges (subscriber-level and above) to perform unauthorized modifications to site content and settings. The issue affects all versions up to and including 1.6.2, with a partial fix applied in 1.6.2. No complete patch or official fix link is provided in the available data.

An attacker with subscriber-level access can modify site content and configuration, including creating pages, altering WooCommerce page titles, changing Elementor settings, importing widgets, and updating customizer and CSS settings. This unauthorized modification can affect site integrity and appearance but does not directly impact confidentiality or availability. The CVSS score of 4.3 reflects a medium severity with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was partially fixed in version 1.6.2, so upgrading to the latest plugin version is recommended if a newer version beyond 1.6.2 is available. Until a full fix is confirmed, restrict subscriber-level access and review user permissions carefully to limit exposure. Monitor vendor channels for an official fix or updated security guidance.