Master Addons - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/master-addons/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 01 Sep 2026 07:03:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary File Upload in Master Addons for Elementorhttps://feed.craftedsignal.io/briefs/2026-09-master-addons-rce/Tue, 01 Sep 2026 07:03:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-master-addons-rce/An improper authorization flaw in the Master Addons for Elementor WordPress plugin allows authenticated users with editor-level access to achieve remote code execution via arbitrary file uploads.The Master Addons for Elementor plugin for WordPress (versions 3.1.9 and earlier) contains an arbitrary file upload vulnerability within the upload_template_kit AJAX handler. The vulnerability stems from insufficient authorization requirements; the handler checks for 'upload_files' capability rather than the stricter 'manage_options' required by other administrative handlers in the plugin. Furthermore, the handler fails to implement adequate file type validation after the extraction of uploaded ZIP archives. An attacker with editor-level privileges can obtain the necessary nonces from the pages list screen and subsequently upload arbitrary, potentially executable files. This vulnerability enables authenticated attackers to execute arbitrary code on the underlying WordPress server.

Impact

Successful exploitation of CVE-2026-75921 grants an authenticated attacker with editor-level access the ability to execute remote code on the host server. This can lead to full site compromise, exfiltration of sensitive database information, or the establishment of persistent backdoors within the WordPress environment.

Recommendation

  • Upgrade the Master Addons for Elementor plugin to the latest available version (beyond 3.1.9) to patch the authorization logic and file validation routines.
  • Review WordPress user accounts and restrict editor-level permissions to trusted individuals to mitigate the potential impact of this credential-dependent vulnerability.
  • Audit web server logs for suspicious POST requests to the plugin's AJAX endpoints if indicators of compromise are suspected.
]]>highadvisory