The ElementsKit Elementor Addons plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the Live_Action::reset() function. This function is hooked to the WordPress init action and executes when both 'post' and 'action=elementor' GET parameters are present. Due to the absence of capability checks and nonce verification, unauthenticated attackers can overwrite the '_elementor_data' of any 'elementskit_widget' custom post type, permanently replacing widget designs, text, and configurations with blank templates. The vulnerability affects all versions up to and including 3.8.2.

An attacker can cause unauthorized modification of Elementor widget content by resetting it to blank templates. This results in loss of custom designs, text, and configurations for the affected widgets. The vulnerability does not disclose sensitive information or allow privilege escalation but impacts data integrity and availability of widget content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's functionality and monitor for suspicious requests containing 'post' and 'action=elementor' GET parameters. Avoid exposing the WordPress site to untrusted users who could exploit this vulnerability.