CVE-2024-5382: 
WordPress vulnerability analysis and mitigation

The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress contains an unauthorized modification vulnerability (CVE-2024-5382) due to a missing capability check on the 'ma-template' REST API route in versions up to and including 2.0.6.1. The vulnerability was disclosed on June 7, 2024 (NVD CVE).

The vulnerability stems from a missing capability check on the 'ma-template' REST API route, which allows unauthorized access to template modification functions. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.3 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) according to NVD, while Wordfence rates it at 6.5 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) (NVD CVE).

This vulnerability enables unauthenticated attackers to create or modify existing Master Addons templates and make settings modifications related to these templates (NVD CVE).

The vulnerability can be exploited by unauthenticated attackers through the REST API endpoint, requiring no special conditions or user interaction (NVD CVE).

Users should update to version 2.0.6.2 or later which contains the security fix (WordPress Patch).