CVE-2026-75921: CWE-863 Incorrect Authorization in pixarlabs Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

CVE-2026-75921 is an incorrect authorization vulnerability (CWE-863) in the Master Addons for Elementor WordPress plugin. The upload_template_kit AJAX handler requires only the upload_files capability rather than the more restrictive manage_options capability used by similar handlers. This allows authenticated users with editor-level access (edit_pages capability) to bypass intended restrictions. Additionally, the handler lacks per-entry file type filtering after extracting ZIP archives, enabling attackers to upload arbitrary files, including executable ones. Because the required nonces are accessible to users with edit_pages capability, editors can satisfy nonce checks, facilitating exploitation. This vulnerability enables remote code execution on affected installations.

An attacker with editor-level privileges or higher can upload arbitrary files, including executable code, leading to remote code execution on the affected WordPress site. This compromises the confidentiality, integrity, and availability of the system. The vulnerability requires authentication but can be exploited by users with relatively low privileges (editors).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict editor-level access to trusted users only and consider disabling or limiting the use of the upload_template_kit functionality if possible.