This vulnerability in ElementsKit Elementor addons Lite arises from missing authorization checks, which means that certain actions or resources may be accessible without proper permission validation. The issue affects versions through 3.9.6. The CVSS 3.1 base score of 5.3 reflects a network attack vector with low attack complexity, no privileges required, and no user interaction needed, impacting confidentiality only. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of May 27, 2026.

An attacker could exploit this missing authorization flaw to gain unauthorized access to certain features or data within the affected plugin, potentially leading to information disclosure. The impact is limited to confidentiality loss, with no reported impact on integrity or availability. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying principle of least privilege and restricting access to the plugin's administrative interfaces may reduce risk, but no specific mitigations are documented by the vendor at this time.