CVE-2026-49782 is classified as a CWE-862 Missing Authorization vulnerability affecting Elementor Website Builder versions up to 4.1.0. The issue arises from improperly configured access control mechanisms, which may allow users with limited privileges to bypass authorization checks and access or modify resources they should not be able to. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact without availability impact. No patch or official remediation has been published by the vendor, and no known exploits have been reported.

The vulnerability could allow an attacker with some level of privileges to perform unauthorized actions due to missing or incorrect authorization checks. This may lead to partial confidentiality and integrity impacts within affected Elementor Website Builder installations. There is no indication of availability impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations where possible and limit user privileges to reduce potential exploitation risk.