ElementsKit Elementor Addons < 3.9.0 - Unauthenticated Missing Authorization to Widget Content Overwrite

Description

The plugin is vulnerable to unauthorized data modification due to a missing capability check on the `Live_Action::reset()` function, which is hooked to the WordPress `init` action and triggers when both `post` and `action=elementor` GET parameters are present with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content (`_elementor_data`) of any `elementskit_widget` custom post type via a specially crafted URL, permanently replacing widget designs, text, and configurations with a blank template.