The Boostify Header Footer Builder for Elementor plugin suffers from a missing capability check in its create_bhf_post function, classified as CWE-862 (Missing Authorization). This flaw enables authenticated users with low privileges (subscriber-level and above) to create arbitrary pages or posts within WordPress, potentially leading to unauthorized content injection. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), reflecting low attack complexity and no user interaction required. No known exploits are reported in the wild, and no patch or vendor advisory is currently provided.

An attacker with subscriber-level access or higher can create arbitrary pages or posts, leading to unauthorized modification of site content. This could be leveraged for defacement, misinformation, or other content-based attacks. The vulnerability does not affect confidentiality or availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unauthorized content creation. Avoid granting subscriber or higher privileges to untrusted users.