CVE-2024-10582

Name of the Vulnerable Software and Affected Versions The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress versions up to, and including, 2.4.1

Description The issue is related to unauthorized modification of data due to a missing capability check on the import mpfe template() function. This allows authenticated attackers with Subscriber-level access and above to import templates.

Recommendations For versions up to, and including, 2.4.1, update to a version that includes a fix for the missing capability check on the import mpfe template() function. As a temporary workaround, consider restricting access to the import mpfe template() function to prevent unauthorized template imports.