Elementor Website Builder EUVD-2026-33933

Exploitation requires a valid low-privilege authenticated WordPress session on the target site - specifically any account granted at least subscriber-level access (confirmed by CVSS PR:L). The target site must be running Elementor Website Builder version 4.1.0 or earlier. The missing authorization check applies to specific plugin-defined actions or REST/AJAX endpoints that do not call WordPress capability verification functions (e.g., current_user_can()). Exploitation is limited by the authentication prerequisite: sites with no user registration, or those restricted to fully trusted users, face no practical risk from external attackers. The impact ceiling is low - CVSS C:L/I:L/A:N/S:U - meaning an attacker cannot achieve full site takeover, code execution, or availability disruption through this vulnerability alone.

The CVSS 5.4 Medium score is consistent with the bounded impact profile: confidentiality and integrity are both rated Low, availability is unaffected, and scope is unchanged, meaning the attacker cannot pivot beyond the plugin's own context. The PR:L requirement is the critical limiting factor - exploitation is gated on possessing any valid low-privilege WordPress account, such as a site subscriber. For WordPress sites with open user registration or multi-user environments (membership platforms, e-commerce, LMS sites), this is a meaningful real-world risk. For sites where authenticated users are exclusively trusted administrators, risk is negligible. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no POC code have been identified, suggesting no observed active exploitation campaigns at time of analysis. The Patchstack 'Authentication Bypass' tag implies the missing check may allow a low-privilege user to perform actions reserved for editors or administrators within the Elementor interface, which could include template manipulation or settings access - potentially significant in multi-author WordPress environments even without full site compromise.

An attacker registers a free subscriber account on a target WordPress site running Elementor 4.1.0 or earlier, then sends crafted authenticated HTTP or AJAX requests to plugin endpoints that lack WordPress capability checks. The missing authorization gate allows the subscriber-level session to read restricted Elementor data or invoke write operations (such as template modification or settings changes) reserved for higher-privileged roles. No public exploit code has been identified, but the low attack complexity (AC:L) indicates exploitation requires no special tooling beyond standard HTTP request crafting once the vulnerable endpoint is identified.