CVE-2026-85410

Overview

An authorization bypass vulnerability exists in the Master Addons for Elementor plugin for WordPress up to version 3.2.2. Due to improper capability checks and overly permissive custom post type configurations, authenticated users with contributor-level access can manipulate or delete arbitrary posts. This undermines content integrity and availability within affected WordPress environments.

Description

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the title and metadata of arbitrary WordPress posts or permanently delete arbitrary WordPress posts by supplying an attacker-controlled popup_id. The required nonce is emitted on the edit-jltma_popup admin screen, which is accessible to Contributors because the jltma_popup custom post type is registered with capability_type='post'.

Impact

Low-privileged authenticated users (contributors and above) can exploit this vulnerability to modify post titles and metadata or permanently delete arbitrary posts. This directly impacts the integrity and availability of organizational web content. Administrators and site owners face operational disruption and potential data loss if malicious modifications occur.

Remediation

Update the Master Addons for Elementor plugin to a version patched against CVE-2026-85410 immediately. Audit user roles and restrict untrusted accounts from obtaining contributor-level access or higher on WordPress sites. Monitor server logs and database change histories for unauthorized post modifications or deletions.

Risk context

The vulnerability carries a high CVSS base score of 8.1, reflecting significant potential impact to data integrity and availability. However, the current EPSS score of 0.00313 indicates a relatively low observed exploitation probability in the wild at this time. Remediation should be prioritized based on exposure and the presence of untrusted user roles.

Affected products

• Master Addons for Elementor plugin
• WordPress