Improper Authorization Vulnerability in Post Carousel Slider for Elementor by WordPress

CVE-2025-3863

What is CVE-2025-3863?

The Post Carousel Slider for Elementor plugin for WordPress is susceptible to improper authorization due to a lack of capability checks in the process_wbelps_promo_form() function. This vulnerability affects all versions up to and including 1.6.0, allowing authenticated users with Subscriber-level access and higher to exploit the plugin's support form handler. As a result, attackers can send arbitrary emails to the site's support address, potentially leading to unauthorized communications and increased risk for site administrators.

References