This vulnerability in merkulove Crumber (crumber-elementor) arises from missing authorization checks, enabling attackers with limited privileges to perform actions beyond their intended access level. It affects all versions up to 1.0.10. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No patch or vendor advisory is available to confirm remediation status.

Exploitation could allow an attacker with some privileges to perform unauthorized actions that degrade the integrity and availability of the affected system. Confidentiality is not impacted. The medium CVSS score reflects a moderate risk due to the potential for disruption without direct data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to access control. Avoid granting unnecessary privileges to users interacting with Crumber.