CVE-2026-91015: CWE-862 Missing Authorization in Master Addons for Elementor
Master Addons for Elementor WordPress plugin versions 3.0.0 up to but not including 3.1.9 contains a missing authorization vulnerability. The plugin fails to properly verify user permissions on an AJAX action that deactivates Popup Builder popups, relying solely on a nonce that is publicly exposed to all visitors. This allows unauthenticated attackers to permanently disable any popup on the affected site.
AI Analysis
Technical Summary
CVE-2026-91015 is a missing authorization vulnerability (CWE-862) in the Master Addons for Elementor WordPress plugin before version 3.1.9. The flaw occurs because the plugin does not perform an authorization check on the AJAX action responsible for deactivating Popup Builder popups. Instead, it relies only on a nonce that is publicly output to every visitor, enabling unauthenticated attackers to disable popups permanently.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to permanently disable any popup created by the Popup Builder feature on a vulnerable WordPress site. This could disrupt site functionality or marketing efforts that rely on popups, but does not directly lead to code execution or data leakage based on the provided information.
Mitigation Recommendations
A fix is available in Master Addons for Elementor version 3.1.9 and later. Site administrators should upgrade to version 3.1.9 or newer to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.
CVE-2026-91015: CWE-862 Missing Authorization in Master Addons for Elementor
Description
Master Addons for Elementor WordPress plugin versions 3.0.0 up to but not including 3.1.9 contains a missing authorization vulnerability. The plugin fails to properly verify user permissions on an AJAX action that deactivates Popup Builder popups, relying solely on a nonce that is publicly exposed to all visitors. This allows unauthenticated attackers to permanently disable any popup on the affected site.
Affected software
Master Addons for Elementor
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-91015 is a missing authorization vulnerability (CWE-862) in the Master Addons for Elementor WordPress plugin before version 3.1.9. The flaw occurs because the plugin does not perform an authorization check on the AJAX action responsible for deactivating Popup Builder popups. Instead, it relies only on a nonce that is publicly output to every visitor, enabling unauthenticated attackers to disable popups permanently.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to permanently disable any popup created by the Popup Builder feature on a vulnerable WordPress site. This could disrupt site functionality or marketing efforts that rely on popups, but does not directly lead to code execution or data leakage based on the provided information.
Mitigation Recommendations
A fix is available in Master Addons for Elementor version 3.1.9 and later. Site administrators should upgrade to version 3.1.9 or newer to remediate this vulnerability. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-14T16:39:59.955Z
- State
- PUBLISHED
Threat ID: 6aab827955bf5e2cf5d4d345
Added to database: 09/17/2026, 06:02:33 UTC
Last enriched: 09/17/2026, 06:16:35 UTC
Last updated: 09/17/2026, 06:21:27 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.