Atomic Edge analysis of CVE-2026-24386 (metadata-based):
This vulnerability is a Missing Authorization flaw in the Element Invader – Template Kits for Elementor WordPress plugin, affecting all versions up to and including 1.2.4. The vulnerability allows any authenticated user, including those with the low-privilege Subscriber role, to perform an unauthorized action due to a missing capability check on a plugin function.

Atomic Edge research identifies the root cause as a missing authorization or capability check on a function registered with WordPress’s AJAX or admin-post hook system. The CWE-862 classification confirms the absence of a proper check, such as `current_user_can()`, before executing a privileged action. This conclusion is inferred from the CWE and the description stating the issue is a ‘missing capability check on a function’. Without the source code, the exact function name is unconfirmed, but the pattern is consistent with WordPress plugin vulnerabilities.

An attacker exploits this by sending a crafted HTTP request to the WordPress AJAX or admin-post endpoint. The request targets the specific action hook the vulnerable function is registered under. For a plugin with the slug ‘elementinvader’, a likely AJAX action is ‘elementinvader_{action_name}’. The attacker, authenticated as a Subscriber, sends a POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to the vulnerable hook and any required parameters for the unauthorized action.

The fix in version 1.2.5 likely adds a proper capability check to the vulnerable function. The patch should verify the requesting user has the necessary permissions, typically using `current_user_can(‘manage_options’)` or a plugin-specific capability, before proceeding with the function’s logic. The patch may also include nonce verification for additional CSRF protection, though the core issue is the missing authorization.

Successful exploitation allows a low-privileged attacker to perform an action reserved for administrators or editors. The CVSS vector indicates a low impact on integrity (I:L) with no effect on confidentiality or availability. The specific unauthorized action is not detailed, but in the context of a template kit plugin, it could involve modifying saved templates, importing/exporting kits, or changing plugin settings, leading to site defacement or disruption of site builders’ work.