Master Addons for Elementor (<= 3.2.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/master-addons-for-elementor--3.2.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 10:06:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in Master Addons for Elementorhttps://feed.craftedsignal.io/briefs/2026-09-master-addons-bypass/Fri, 18 Sep 2026 10:06:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-master-addons-bypass/An authorization bypass vulnerability in the Master Addons for Elementor WordPress plugin allows authenticated contributors to modify or delete arbitrary posts.The Master Addons for Elementor plugin for WordPress is vulnerable to an authorization bypass flaw, tracked as CVE-2026-85410, affecting all versions up to and including 3.2.2. The vulnerability stems from improper capability verification when handling the jltma_popup custom post type. Because this post type is registered with 'capability_type' set to 'post', WordPress grants contributor-level users access to the associated admin screen. This screen exposes a nonce required to execute administrative actions. Attackers with contributor access can leverage this exposed nonce to bypass authorization controls, allowing them to modify the title and metadata of arbitrary posts or permanently delete posts by supplying an attacker-controlled 'popup_id' parameter to the plugin's backend endpoints.

Impact

Successful exploitation allows authenticated users with contributor-level permissions to escalate their capabilities to delete or modify any post on the affected WordPress site, potentially leading to unauthorized data modification, defacement, or total loss of content. This impact is significant for sites with multiple contributors or where contributor accounts may be compromised.

Recommendation

  1. Patch immediately by upgrading the Master Addons for Elementor plugin to a version beyond 3.2.2.
  2. Audit user accounts with contributor-level access to identify potentially unauthorized activity or compromise.
  3. Review web server access logs for anomalous POST requests targeting the plugin's administrative endpoints associated with 'jltma_popup' actions from contributor accounts.
]]>highadvisorywordpressvulnerabilityauthorization-bypass