This vulnerability in Element Invader – Template Kits for Elementor (up to version 1.2.4) is due to missing authorization checks, which results in incorrect access control enforcement. An attacker with limited privileges may exploit this flaw to perform unauthorized actions that affect the integrity of the system. The CVSS score is 4.3 (medium), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, and impact limited to integrity.

The vulnerability allows an attacker with some privileges to bypass proper authorization controls, potentially modifying data or configurations without proper permission. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin features to trusted users only and monitor for unusual activity related to access control. Avoid granting unnecessary privileges to users interacting with the plugin.