Lucene search

K
wpvulndbWpvulndbWPVDB-ID:0EC90411-9600-4D2A-839D-1F53FFC82BE1
HistoryJun 07, 2024 - 12:00 a.m.

Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor < 2.0.6.2 - Missing Authorization to MA Template Creation or Modification

2024-06-0700:00:00
wpscan.com
wordpress
elementor
vulnerable
data modification
unauthorized access
rest api

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

6.7 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

Description The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘ma-template’ REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.

CPENameOperatorVersion
eq2.0.6.2

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

6.7 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

Related for WPVDB-ID:0EC90411-9600-4D2A-839D-1F53FFC82BE1