Arbitrary File Upload in Master Addons for Elementor

The Master Addons for Elementor plugin for WordPress (versions 3.1.9 and earlier) contains an arbitrary file upload vulnerability within the upload_template_kit AJAX handler. The vulnerability stems from insufficient authorization requirements; the handler checks for 'upload_files' capability rather than the stricter 'manage_options' required by other administrative handlers in the plugin. Furthermore, the handler fails to implement adequate file type validation after the extraction of uploaded ZIP archives. An attacker with editor-level privileges can obtain the necessary nonces from the pages list screen and subsequently upload arbitrary, potentially executable files. This vulnerability enables authenticated attackers to execute arbitrary code on the underlying WordPress server.

Impact

Successful exploitation of CVE-2026-75921 grants an authenticated attacker with editor-level access the ability to execute remote code on the host server. This can lead to full site compromise, exfiltration of sensitive database information, or the establishment of persistent backdoors within the WordPress environment.

Recommendation

• Upgrade the Master Addons for Elementor plugin to the latest available version (beyond 3.1.9) to patch the authorization logic and file validation routines.
• Review WordPress user accounts and restrict editor-level permissions to trusted individuals to mitigate the potential impact of this credential-dependent vulnerability.
• Audit web server logs for suspicious POST requests to the plugin's AJAX endpoints if indicators of compromise are suspected.