The vulnerability CVE-2026-25028 involves missing authorization checks in the ElementInvader Addons for Elementor plugin, versions up to 1.4.1. This incorrect configuration of access control security levels permits users with limited privileges to perform actions or access data beyond their intended scope. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact without availability impact. No patch or remediation details are currently available from the vendor or advisory sources.

Exploitation of this vulnerability could allow an attacker with limited privileges to bypass access controls, potentially leading to unauthorized disclosure or modification of data within the affected plugin. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges to minimize exposure. Monitor for updates from the vendor regarding patches or mitigations.