Unauthorized Access Vulnerability in Master Addons for Elementor Plugin
CVE-2026-91015
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2026
Badges
What is CVE-2026-91015?
The Master Addons for Elementor plugin for WordPress prior to version 3.1.9 contains a serious security issue. It lacks adequate authorization checks for its AJAX actions related to the Popup Builder functionality. This vulnerability allows unauthenticated users to exploit the non-restricted AJAX action tied to the plugin, enabling them to deactivate any popup on the website. Since the nonce used for this action is publicly accessible, attackers can easily disable critical popup features, which may lead to misuse or manipulation of website content.
Affected Version(s)
Master Addons for Elementor 3.0.0 < 3.1.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.