The WPElemento Importer plugin for WordPress versions up to 0.6.4 suffers from a missing authorization vulnerability. This flaw allows users with low privileges to bypass access control restrictions, potentially leading to unauthorized actions within the plugin's functionality. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring low privileges, no user interaction, and causing limited integrity impact without confidentiality or availability impact.

The vulnerability allows an attacker with low privileges to perform unauthorized actions within the WPElemento Importer plugin, potentially modifying data or configurations improperly. There is no impact on confidentiality or availability. No known exploits have been reported, so the practical impact may be limited until exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WPElemento Importer plugin to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users who do not require them for their role.