CVE-2026-75921: Master Addons for Elementor RCE Vulnerability

CVE-2026-75921 Overview

CVE-2026-75921 is an arbitrary file upload vulnerability in the Master Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 3.1.9. The vulnerability resides in the upload_template_kit() AJAX handler, which performs insufficient capability checks and lacks per-entry file type filtering after ZIP extraction. Authenticated attackers with editor-level access can upload executable files and achieve remote code execution on the target WordPress site. The weakness is categorized as CWE-863: Incorrect Authorization.

Critical Impact
Editor-level users can upload arbitrary files through the template kit importer, enabling remote code execution and full compromise of the WordPress installation.

Affected Products

Master Addons for Elementor plugin for WordPress
All versions up to and including 3.1.9
WordPress sites where editors or higher-privileged users exist

Discovery Timeline

2026-09-01 - CVE-2026-75921 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75921

Vulnerability Analysis

The vulnerability exists in the upload_template_kit AJAX handler exposed by the Master Addons for Elementor plugin. The handler accepts a ZIP archive from an authenticated user, extracts its contents, and imports them as a template kit. Unlike sibling handlers in the same plugin, upload_template_kit() performs an authorization check requiring only the upload_files capability instead of manage_options. This gap allows any user with editor privileges to reach code paths that were intended to be restricted to administrators. Further technical detail is available in the Wordfence Vulnerability Report.

Root Cause

Two defects combine to produce the impact. First, the handler applies an incorrect capability gate that grants editors access to an administrative import function. Second, after the uploaded ZIP is extracted, the plugin does not validate the file type of each extracted entry. Any executable PHP file inside the archive is written to disk within the web root. Related code paths can be reviewed in the Master Addons page-importer source and the class-importer source.

Attack Vector

The attacker authenticates as a user with the edit_pages capability, which includes standard editors. The nonce required by the AJAX handler is localized on the Pages list screen, so editors can retrieve a valid nonce during normal navigation. The attacker then submits a crafted ZIP archive containing a PHP webshell to the upload_template_kit endpoint. The plugin extracts the archive without per-entry filtering, dropping the webshell into the WordPress uploads directory. The attacker requests the file over HTTP and executes arbitrary PHP under the web server account.

No verified proof-of-concept code has been published. The vulnerability mechanism is documented in prose above and in the linked source references.

Detection Methods for CVE-2026-75921

Indicators of Compromise

POST requests to admin-ajax.php with the action=upload_template_kit parameter originating from non-administrator sessions
New .php, .phtml, or .phar files appearing under wp-content/uploads/ or Master Addons template kit directories
ZIP archives written and extracted in template kit import paths shortly before unfamiliar PHP files appear
Outbound connections from the web server process to unfamiliar hosts following template kit imports

Detection Strategies

Alert on any HTTP request to admin-ajax.php invoking the upload_template_kit action, and correlate with the authenticated user role
Monitor file integrity across the wp-content/uploads/ tree for newly written PHP files
Inspect WordPress audit logs for editor accounts triggering template kit imports, which is atypical for that role

Monitoring Recommendations

Enable web server access logging with full query strings to capture AJAX action names
Deploy a WordPress activity log plugin to record role changes, plugin activity, and file operations
Review web root contents on a scheduled basis and compare against a known-good baseline

How to Mitigate CVE-2026-75921

Immediate Actions Required

Update the Master Addons for Elementor plugin to a release above 3.1.9 as soon as the vendor publishes a patched version
Audit editor and higher-privileged accounts, and remove or downgrade any that are not strictly required
Search the WordPress uploads directory for unexpected PHP files and remove any that are not part of a known template
Rotate credentials and secrets for any site that shows evidence of the upload_template_kit action being invoked by non-administrators

Patch Information

The plugin author committed changes tracked in the Master Addons changeset overview. Administrators should install the fixed version through the WordPress plugin updater once available and verify the installed version is greater than 3.1.9.

Workarounds

Deactivate the Master Addons for Elementor plugin until the patched version is installed
Restrict PHP execution in the wp-content/uploads/ directory using web server configuration to blunt webshell drops
Limit editor accounts and enforce multi-factor authentication for all users at or above editor level

bash

# Apache: block PHP execution in wp-content/uploads
# Place the following in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>