The ElementsKit Elementor Addons plugin for WordPress versions up to 3.8.2 contains a missing authorization vulnerability (CWE-862) in the Live_Action::reset() function. This function is hooked to the WordPress 'init' action and executes when both 'post' and 'action=elementor' GET parameters are present. Because there is no capability check or nonce verification, unauthenticated attackers can invoke this function to overwrite the '_elementor_data' of any 'elementskit_widget' custom post type. The attack results in the permanent loss of custom widget content, including designs, text, and configurations, by replacing them with a blank template.

An attacker without authentication can cause integrity and availability impacts by permanently erasing and replacing Elementor widget content with blank templates. This disrupts website functionality and content presentation but does not disclose sensitive data or allow privilege escalation. The CVSS 3.1 score is 6.5 (medium), reflecting network attack vector, no privileges required, no user interaction, and impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's functionality by limiting access to the WordPress admin area and monitoring for suspicious GET requests containing 'post' and 'action=elementor' parameters. Avoid exposing the site to unauthenticated users who could trigger this vulnerability.