This vulnerability in merkulove Masker for Elementor (up to version 1.1.4) is due to missing authorization checks, which results in incorrect access control configurations. An attacker with low privileges could exploit this to gain unauthorized access or perform actions beyond their intended permissions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and limited impact on confidentiality and integrity.

The vulnerability allows an attacker with some level of privileges to bypass access control restrictions, potentially leading to unauthorized information disclosure or modification within the plugin's functionality. There is no impact on system availability. No exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges to minimize risk. Monitor for updates from merkulove regarding patches or official mitigations.