Elementor Website Builder CVE-2025-67588

Exploitation requires a valid WordPress user account with at minimum subscriber-level access, as reflected by the PR:L CVSS metric. The target site must have Elementor Website Builder version 3.33.0 or earlier installed and active. The specific Elementor feature or endpoint affected is not named in the available data, but the vulnerability class (CWE-862) implies a missing capability check on at least one privileged action. Exploitation is limited by: the need for a WordPress account (open registration must be enabled or the attacker must obtain credentials by other means), the absence of confidentiality impact (data theft is not a direct outcome), and the S:U scope (the compromise is contained to the Elementor plugin's own operations, not the broader WordPress installation or server).

The composite risk picture here is low-to-moderate. The CVSS base score of 4.3 (Medium) is consistent with the bounded impact: integrity-only, limited scope, no confidentiality or availability consequences. EPSS at 0.05% (14th percentile) corroborates that mass exploitation is not occurring. There is no CISA KEV entry and no public proof-of-concept. The PR:L requirement is a meaningful limiting factor - an unauthenticated visitor cannot trigger this; a valid WordPress account is needed, which reduces the exposed population considerably. Even a mid-sized municipal IT team in sopot running a subscriber-registration-enabled Elementor site should treat this as a patch-and-monitor item rather than an emergency, provided public registration is disabled or restricted. The 'Authentication Bypass' tag applied to this CVE is misleading - this is a post-authentication authorization failure (broken access control), not a bypass of the authentication mechanism itself, which slightly inflates perceived severity. Overall, patching is straightforward and recommended, but the realistic blast radius without a public exploit is narrow.

An attacker registers or otherwise obtains a low-privilege WordPress account on a target site running Elementor 3.33.0 or earlier. They then send a crafted authenticated HTTP request - likely a POST to an admin-ajax.php action or a REST API endpoint - that invokes a privileged Elementor operation without the required capability check. The result is an unauthorized modification to site content, settings, or widget configuration, limited in scope to what the unguarded endpoint permits.