CVE-2026-91015 in Master Addons for Elementor Plugin
Summary
by MITRE • 09/17/2026
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Master Addons for Elementor prior to version 3.1.9 represents a critical failure in access control mechanisms within WordPress plugin architecture. Specifically, the flaw resides in the AJAX action responsible for deactivating popups created by the Popup Builder feature. In secure web application design, actions that modify state or perform administrative functions must enforce strict authorization checks to ensure that only authenticated users with appropriate privileges can execute them. However, this implementation relies exclusively on a nonce value for security validation. While nonces are intended to prevent Cross-Site Request Forgery attacks by ensuring the request originated from an authorized source within a specific time window, they do not inherently verify user identity or permissions if improperly implemented.
The core technical flaw is that the nonce generated and outputted during page rendering is publicly accessible to any visitor viewing the site's HTML source code. Because the server-side validation logic accepts this public nonce as sufficient proof of authorization without cross-referencing it against a valid, authenticated session with elevated privileges, an unauthenticated attacker can trivially extract the token from the webpage. By capturing this value and constructing a malicious AJAX request targeting the deactivation endpoint, the attacker bypasses all intended security controls. This effectively renders the nonce useless as a protective measure because its secrecy is compromised by being embedded in client-side code accessible to anyone with basic browser developer tools or simple HTTP scraping capabilities.
The operational impact of this vulnerability allows unauthenticated remote attackers to permanently disable any popup configured on the affected WordPress site. Since popups are often used for critical marketing, user engagement, security warnings, or lead generation, their unauthorized deactivation can result in significant business disruption and loss of functionality. An attacker could systematically remove all active popups, causing a denial of service effect specific to these features without needing any credentials. This level of control over site configuration highlights the severity of improper authorization checks, as it allows external actors to alter the functional behavior of the application with minimal effort and no prior authentication.
From a classification perspective, this vulnerability aligns directly with CWE-284, which describes Improper Access Control, specifically where access controls are bypassed due to insufficient verification of user permissions. It also relates to CWE-352 regarding Cross-Site Request Forgery, although the primary issue is not just forgery but the lack of authentication requirements for state-changing operations. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1078 Valid Accounts if credentials were used, or more accurately T1496 Resource Hijacking in a broad sense of disrupting service availability, though it best fits under techniques involving exploitation of misconfigured access controls that allow unauthorized modification of application state.
To mitigate this vulnerability, site administrators must immediately update the Master Addons for Elementor plugin to version 3.1.9 or later, where the authorization logic has been corrected to properly verify user capabilities alongside nonce validation. Developers should ensure that all AJAX endpoints performing administrative or destructive actions enforce capability checks using WordPress functions such as current_user_can before processing any requests. Relying solely on nonces is insufficient for protecting sensitive operations; authentication and authorization must be explicitly validated server-side regardless of the presence of anti-CSRF tokens. Regular security audits and adherence to secure coding standards are essential to prevent similar access control failures in future updates or other plugins within the ecosystem.