The Easy Elements for Elementor plugin for WordPress is vulnerable to a critical privilege escalation flaw, potentially allowing authenticated users to gain unauthorized administrative access.

The plugin suffers from an improper privilege management vulnerability (CWE-269). The flaw allows an authenticated attacker with low privileges to escalate their permissions, potentially leading to a full site compromise.

A successful exploit of this vulnerability could grant an attacker administrative control over the WordPress environment. This level of access allows for total data compromise, the injection of malicious content, and potential site-wide disruption, carrying severe reputational and operational risks. The CVSS score of 8.8 reflects the high severity of this privilege escalation risk.

Immediate Action: As there is currently no patched version available, administrators should immediately deactivate and remove the plugin from the production environment until a fix is released.

Proactive Monitoring: Review WordPress user account logs for unauthorized privilege changes or the creation of new administrator accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin-specific functionality.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Given the high severity of this privilege escalation flaw and the confirmed existence of public proof-of-concept code, this vulnerability poses an immediate threat. Organizations must prioritize the removal of the vulnerable plugin until a secure, patched version is provided by the vendor.