This vulnerability in Elementor Website Builder versions up to 3.33.0 is caused by missing authorization checks, resulting in incorrect access control enforcement. An attacker with low privileges (PR:L) can exploit this issue remotely (AV:N) without user interaction (UI:N) to perform unauthorized actions that affect data integrity (I:L), but not confidentiality or availability. The CVSS base score is 4.3, indicating medium severity. No official patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability allows an attacker with some level of privileges to bypass proper authorization controls, potentially modifying data or performing unauthorized actions within the Elementor Website Builder. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in Elementor Website Builder to limit privilege escalation risks. Monitor for vendor updates regarding patches or official mitigations.