Master Addons for Elementor Premium Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Master Addons for Elementor Premium plugin for WordPress, affecting all versions through 2.1.3. The issue arises in the 'JLTMA_Widget_Admin::render_preview' function, where a missing capability check allows authenticated attackers with Subscriber-level access and above to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the vulnerable WordPress site is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'wp_ajax_jltma_widget_render_preview' action. This request can include a nonce for verification, but the absence of proper capability checks in the targeted function will allow the execution of malicious PHP code.

Remediation

Users are advised to update the Master Addons for Elementor Premium plugin to version 2.1.4 or a newer patched version.