CVE-2024-5382

2024-06-0713:15:50

CWE-862

[email protected]

web.nvd.nist.gov

cve-2024-5382

master addons

wordpress

vulnerability

unauthorized access

data modification

rest api

attackers

templates

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

0.0005 Low

EPSS

Percentile

17.0%

JSON

The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘ma-template’ REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.

Affected configurations

Vulners

NVD

Node

litonice13master_addons_–_free_widgets\,_hover_effects\,_toggle\,_conditions\,_animations_for_elementorRange≤2.0.6.1

CPENameOperatorVersion
master-addons:master_addonsmaster-addons master addonslt2.0.6.2

CPE	Name	Operator	Version
master-addons:master_addons	master-addons master addons	lt	2.0.6.2

CNA Affected

[
  {
    "vendor": "litonice13",
    "product": "Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.0.6.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]