This vulnerability in Ultimate Addons for Elementor involves improper privilege management (CWE-269), enabling an attacker with some level of privilege to escalate their privileges further. The affected versions include all versions up to 1.36.31. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and it is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with limited privileges to escalate their privileges, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized access, modification, or disruption of the affected WordPress environment using the Ultimate Addons for Elementor plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's management interfaces and monitoring for suspicious privilege escalation attempts. Avoid granting unnecessary privileges to users who can interact with this plugin.