# CVE-2026-62089: Pixar Labs Master Addons for Elementor broken access control

Source: https://junglewise.ai/threats/cve-2026-62089-pixar-labs-master-addons-for-elementor-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-62089 · Severity: high · CVSS 7.1 · Published 2026-09-11

Master Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional content components and functionality. A broken access control vulnerability allows authenticated users with the Contributor role to access and potentially modify pages or perform actions they should not be permitted to perform, exposing sensitive site content and functionality to unauthorized modification.

## Quick answers

**Is CVE-2026-62089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62089 being exploited in the wild.

**How severe is CVE-2026-62089?** High severity, with a CVSS score of 7.1, published 11 September 2026.

**Which products and versions are affected?** Pixar Labs Master Addons for Elementor up to 3.2.2.

**Is there a fix for CVE-2026-62089?** A patch was published on 2026-09-11: Version 3.2.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62089 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-62089?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control (CWE-639) issue in Master Addons for Elementor versions up to 3.2.2. An authenticated attacker with Contributor-level privileges can bypass authorization checks to access or manipulate restricted resources on the site. The vulnerability requires authentication and an account with at least Contributor role permissions. An attacker can exploit this to view, access, or potentially modify pages and actions beyond their granted role capabilities. The vulnerability was patched in version 3.2.3.

## Affected products

- Pixar Labs Master Addons for Elementor up to 3.2.2

## Timeline

- 2026-07-23: disclosed: Vulnerability reported to Patchstack
- 2026-09-11: advisory: Published by Patchstack and NVD
- 2026-09-11: patched: Version 3.2.3 released with fix

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/master-addons/vulnerability/wordpress-master-addons-for-elementor-plugin-3-2-2-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/master-addons/vulnerability/wordpress-master-addons-for-elementor-plugin-3-2-2-broken-access-control-vulnerability?_s_id=cve)