Missing Authorization vulnerability Affects Master Addons for Elementor
CVE-2024-35660

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Master Addons For Elementor
Vendor
CVE Published:
9 June 2024

What is CVE-2024-35660?

A missing authorization vulnerability exists in the Jewel Theme Master Addons for Elementor, specifically impacting versions from n/a up to 2.0.5.4.1. This vulnerability allows unauthorized users to access certain functions that should require authenticated user permissions, potentially leading to unauthorized actions within the application. Security measures should be put in place to mitigate the risk associated with improper access controls on the API.

Affected Version(s)

Master Addons for Elementor <= 2.0.5.4.1

References

https://patchstack.com/database/vulnerability/master-addo...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khalid (Patchstack Alliance)
.
CVE-2024-35660 : Missing Authorization vulnerability Affects Master Addons for Elementor