The Master Addons For Elementor plugin for WordPress suffers from a missing capability check (CWE-862) on the 'ma-template' REST API endpoint in all versions up to 2.0.6.1. This flaw permits unauthenticated users to create or alter Master Addons templates or their settings without proper authorization. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and low availability impact.

An attacker can modify or create templates and settings in the Master Addons plugin without authentication, potentially altering site content or behavior. This unauthorized modification can affect the integrity and availability of the affected WordPress site. There is no indication of confidentiality compromise. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress REST API endpoints where possible and monitor for suspicious activity related to template modifications. Avoid using affected versions of the plugin in sensitive environments.