This vulnerability, identified as CVE-2026-74003, affects RomethemeForm For Elementor versions up to 1.2.6. It is classified under CWE-862 (Missing Authorization), indicating that the component lacks proper authorization controls. The CVSS 3.1 base score is 4.3 (medium), with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impacts integrity but not confidentiality or availability. No vendor advisory or patch information is provided, and no exploits are known to be active.

An attacker with low privileges could exploit the missing authorization controls to perform unauthorized actions that may alter data or application state, impacting integrity. There is no impact on confidentiality or availability reported. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component to trusted users only and monitor for unusual activity related to authorization bypass attempts.