CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
Master Addons for Elementor Premium versions up to 2.1.3 contain a code injection vulnerability that allows authenticated users to execute arbitrary PHP code on the site. An attacker with low-level access can inject and run malicious code without user interaction. This affects the plugin's core functionality and poses a severe risk to site integrity and data security.
What an attacker can do
Run arbitrary PHP code on the site with the privileges of the web server.
Potential impact on your site
Attackers with low-level accounts can compromise your entire site, steal data, modify content, or install backdoors.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
