This vulnerability involves missing authorization checks in the Unlimited Elements For Elementor plugin (Free Widgets, Addons, Templates) versions up to 1.5.109. An attacker with low privileges can potentially access or trigger functionality that should require higher authorization. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No official patch or vendor advisory is currently available.

The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported. An attacker with low privileges could access information or functionality not intended for them, but the overall severity is medium. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, monitor for updates from the vendor or security advisories related to Unlimited Elements For Elementor. Avoid granting unnecessary privileges to users of the plugin to reduce risk.