PT-2024-35935
CVE-2024-5382
·
تاريخ النشر
2024-06-07
·
تاريخ التحديث
2024-06-11
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions:
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress versions up to, and including, 2.0.6.1
Description:
The issue allows unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
Recommendations:
For versions up to, and including, 2.0.6.1, consider disabling access to the 'ma-template' REST API route until a patch is available. Restricting the use of the Master Addons templates or settings modifications can also help minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾