The HT Mega Addons for Elementor plugin suffers from an incorrect authorization vulnerability (CWE-863) due to insufficient capability checks in the 'ajax_trash_templates' function. This allows authenticated users with Contributor or higher privileges to perform unauthorized actions such as deleting attachments and trashing content. The vulnerability affects all versions up to and including 2.9.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity impact with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Exploitation allows authenticated users with Contributor-level access or above to delete arbitrary attachment files and move posts, pages, and templates to the Trash. This can lead to unauthorized content modification and potential data loss. There is no indication of confidentiality or availability impact beyond content integrity loss. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor for vendor updates. Until a fix is available, restrict Contributor-level access carefully and consider limiting plugin usage or disabling affected functionality if possible.