Medium severity · published Jun 7, 2024
CVE-2024-5382
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ma-template' REST API route in all versions up to, and including, 2.0.6.1. This makes it possible for unauthenticated attackers to create or modify existing Master Addons templates or make settings modifications related to these templates.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits · litonice13
through 2.0.6.1 · source: vendor
MA
Master Addons · Master-addons
before 2.0.6.2 · source: NVD
FW
Free Widgets For Elementor Plugin · Wordpress
through 2.0.6.1 · source: CISA
Affected product
MA
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
litonice13
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5382
Patch
https://plugins.trac.wordpress.org/changeset/3096299/master-addons
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e3820f80-9b80-4672-b2ff-3864793d2de2?source=cve
More from Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
6.4
CVE-2026-9281
Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)
6.4
CVE-2026-2486
Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'
6.4
CVE-2025-8874
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox
6.4
CVE-2025-5284
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.1
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter