CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_mpfe_template() function in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import templates.
Explanation of Vulnerability in Simple Terms
The Music Player for Elementor plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify plugin settings or data they should not have access to. The vulnerability affects versions up to 2.4.1. Update to a version newer than 2.4.1 to resolve this issue.
What an attacker can do
A low-privilege logged-in user can modify plugin settings or data without proper authorization.
Potential impact on your site
Unauthorized users may alter audio player settings, content, or configuration affecting site functionality.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
