Executive brief
Master Addons for Elementor is a WordPress plugin that provides page building and content management features. The plugin has an authorization flaw that allows authenticated contributors to modify or delete arbitrary posts without proper permission checks, potentially compromising site content integrity and availability.
Technical details
The vulnerability is an authorization bypass in the popup builder component of the Master Addons for Elementor plugin (all versions up to 3.2.2). The plugin fails to properly verify user authorization before allowing modifications to post metadata and deletion. Authenticated attackers with contributor-level access can exploit this by supplying an attacker-controlled popup_id parameter to modify titles and metadata of arbitrary WordPress posts or permanently delete them. The vulnerability exists because the jltma_popup custom post type is registered with capability_type='post', making the nonce-protected edit screen accessible to contributors. No patch status is indicated in the advisory.
Affected products
- JoomlaTheme Master Addons for Elementor up to 3.2.2
Timeline
- 2026-09-18: disclosed