The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.2.7. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugins settings.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mega_addons_for_wpbakery_page_builder | Topdigitaltrends | * | 4.2.7 (including) |