CVE-2025-3863 is an improper authorization vulnerability (CWE-862) in the Post Carousel Slider for Elementor WordPress plugin. The issue arises because the process_wbelps_promo_form() function lacks a proper capability check, enabling authenticated users with minimal privileges (Subscriber or above) to trigger the plugin's support form handler to send arbitrary emails to the configured support address. This vulnerability affects all versions up to and including 1.6.0. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, causing limited impact to integrity but no confidentiality or availability impact.

An attacker with Subscriber-level access or higher can exploit this vulnerability to send arbitrary emails via the plugin's support form handler. This could be used to conduct phishing or spam campaigns leveraging the site's support email address. There is no direct impact on confidentiality or availability reported. The vulnerability does not allow privilege escalation or code execution based on the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting Subscriber-level user capabilities or disabling the plugin if feasible to prevent exploitation.