CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
Explanation of Vulnerability in Simple Terms
Master Addons For Elementor versions up to 2.0.6.1 lack proper authorization checks, allowing unauthenticated attackers to modify site data. The vulnerability affects the plugin's core functionality without requiring user interaction. Site administrators should update to a version newer than 2.0.6.1 to prevent unauthorized changes to site content and settings.
What an attacker can do
Modify site data and settings without authentication.
Potential impact on your site
Attackers can alter your site's content, settings, or functionality without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
