Masterstudy Elementor Widgets CVE-2025-64210

Exploitation requires an authenticated WordPress session on a site running the MasterStudy Elementor Widgets plugin at version 1.2.4 or earlier; per CVSS PR:L the attacker needs at least a low-privilege account (such as a student/subscriber registered on the site), so sites that permit open user registration are more exposed. The flaw is a missing authorization check on plugin functionality, meaning the attacker leverages an existing account to reach actions or data that should require a higher role. Limiting factors: valid low-privilege credentials are mandatory (no unauthenticated exploitation), no user interaction is needed (UI:N), and the plugin must be installed and active alongside Elementor; impact is bounded to partial confidentiality and integrity (C:L/I:L) with no availability effect.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a vendor-assigned CVSS of 5.4 and a provided vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network-reachable, low-complexity exploitation that requires a low-privilege authenticated account and yields only partial confidentiality and integrity impact with no availability effect. All exploitation signals point toward low real-world urgency rather than an emergency: EPSS is 0.18% (6th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided data, so the exploitation status is best described as no public exploit identified at time of analysis. The PR:L requirement is the key risk limiter - an attacker must already hold a valid (likely subscriber/student-level) WordPress account, which narrows this to authenticated privilege-boundary abuse rather than mass unauthenticated compromise. The low EPSS is consistent with the absence of KEV and POC signals, so there is no conflict among the indicators; however, note the input Tags label this 'Authentication Bypass' while the CWE (862) and vector (PR:L) describe a missing-authorization/broken-access-control issue for an already-authenticated user - these are distinct, and the CWE/vector should be treated as authoritative over the tag. Overall this is a genuine but non-priority access-control bug: patch in routine cycles rather than treating as a drop-everything emergency.

An attacker registers or obtains a low-privilege account (e.g., student/subscriber) on a WordPress site running MasterStudy Elementor Widgets <= 1.2.4, then issues a crafted request to a plugin endpoint that fails to verify the caller's authorization level. Because the access-control check is missing, the attacker reads or modifies data or functionality intended for higher-privilege roles, gaining limited confidentiality and integrity impact. No public proof-of-concept was identified in the provided data, and exploitation requires an authenticated session per the CVSS PR:L metric.