This vulnerability in Royal Elementor Addons allows unauthorized access to certain functionality due to improper access control enforcement. Specifically, functionality from an untrusted control sphere is included without proper ACL constraints, enabling potential unauthorized integrity-impacting actions. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. The affected versions include all versions up to and including 1.7.1052. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows attackers to access functionality that should be restricted, potentially leading to unauthorized modification or disruption of the affected system's operations. The CVSS vector indicates no confidentiality impact but a high impact on availability and some impact on integrity. This could result in denial of service or unauthorized changes within the plugin's scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected plugin and monitor for updates from the vendor. No specific mitigations are provided in the available data.