CVE-2026-85410: Master Addons Auth Bypass Vulnerability

CVE-2026-85410 Overview

CVE-2026-85410 is an authorization bypass vulnerability in the Master Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 3.2.2. The plugin fails to verify that a user is authorized to perform post management actions tied to the jltma_popup custom post type. Authenticated attackers with Contributor-level access or above can supply an attacker-controlled popup_id to modify the title and metadata of arbitrary WordPress posts or permanently delete them. The required nonce is emitted on the edit-jltma_popup admin screen, which Contributors can reach because the custom post type is registered with capability_type='post'.

Critical Impact
Contributor accounts can tamper with or destroy arbitrary WordPress posts across the site, including content owned by administrators.

Affected Products

Master Addons for Elementor plugin for WordPress
All versions up to and including 3.2.2
WordPress sites permitting Contributor-level registration or accounts

Discovery Timeline

2026-09-18 - CVE-2026-85410 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-85410

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw [CWE-862] in the popup builder component of Master Addons for Elementor. The plugin's popup admin handlers accept a popup_id parameter from the request without validating that the caller owns or has rights to the target object. Because the handlers only check for a valid nonce, and the nonce is rendered on an admin screen accessible to Contributors, the authorization boundary collapses. An attacker holding a Contributor account can pivot from editing their own popup drafts to modifying or deleting any post in the WordPress database, including pages, published posts, and content authored by administrators.

Root Cause

The root cause is reliance on nonce verification as the sole access control on privileged post operations. The affected handlers in class-popup-admin.php do not call current_user_can() against the specific target post ID before executing title updates, metadata writes, or delete operations. Registering the jltma_popup custom post type with capability_type='post' grants Contributors visibility of the edit screen, which exposes a valid nonce that then satisfies the weak authorization check.

Attack Vector

Exploitation requires an authenticated session at Contributor level or higher. The attacker loads the edit-jltma_popup admin screen to harvest a valid nonce, then submits a crafted request to the vulnerable popup admin endpoints with a popup_id set to any post ID on the site. The backend performs the requested action against the substituted post ID. No user interaction from a victim is required, and the request travels over the standard network attack surface of the WordPress admin. Refer to the Wordfence Vulnerability Report and the WordPress Popup Admin Code for the affected call sites.

Detection Methods for CVE-2026-85410

Indicators of Compromise

Requests from Contributor or Author accounts to popup admin actions referencing popup_id values that do not correspond to jltma_popup objects owned by the requester.
Unexpected post_title or postmeta changes on published posts and pages, especially where the modifying user lacks edit_others_posts.
Unexplained post deletions or entries appearing in the WordPress trash attributed to low-privilege users.

Detection Strategies

Audit web server and WordPress logs for admin-ajax or admin-post requests targeting Master Addons popup handlers with popup_id parameters.
Compare post_modified timestamps against the acting user's role and capabilities to surface unauthorized edits.
Enable WordPress audit logging plugins to record post updates and deletions with the initiating user ID.

Monitoring Recommendations

Alert on any Contributor-level account performing bulk post modifications or deletions within a short window.
Monitor for creation of new low-privilege accounts followed by activity against the edit-jltma_popup admin screen.
Track installed plugin versions across managed WordPress fleets and flag hosts running Master Addons 3.2.2 or earlier.

How to Mitigate CVE-2026-85410

Immediate Actions Required

Update Master Addons for Elementor to the version published in the WordPress Changeset Update that introduces proper capability checks.
Review Contributor, Author, and Editor accounts and remove any that are unrecognized or unused.
Restore any posts modified or deleted through unauthorized activity from backups.

Patch Information

The vendor addressed the missing authorization checks in the plugin changeset referenced above. Site owners should upgrade to the fixed release beyond 3.2.2 as soon as it is available in the WordPress plugin repository. Verify the installed version through the WordPress admin dashboard after upgrading.

Workarounds

Deactivate the Master Addons for Elementor plugin until patched versions can be deployed and validated.
Restrict user registration and disable Contributor-level self-registration where feasible.
Place the WordPress admin behind IP allowlisting or a web application firewall rule that blocks popup admin actions from non-administrator sessions.

bash

# Configuration example: quickly disable the vulnerable plugin via WP-CLI
wp plugin deactivate master-addons
wp plugin status master-addons