This vulnerability in Criptopayer for Elementor arises from missing authorization checks, which means that users with limited privileges may perform actions beyond their intended access level. The CVSS 3.1 score of 5.4 reflects a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacts integrity and availability without affecting confidentiality. The affected versions include all versions up to 1.0.1. No vendor advisory or patch information is provided, and the product is not a cloud service.

The vulnerability allows attackers with some level of privileges to bypass proper access controls, potentially leading to unauthorized modification or disruption of the plugin's functionality. Confidential data is not impacted, but integrity and availability of the affected system may be compromised. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for unusual activity related to the plugin. Avoid granting unnecessary permissions to users interacting with Criptopayer for Elementor.